From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lf1-f50.google.com (mail-lf1-f50.google.com [209.85.167.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 556C4372EC2 for ; Wed, 22 Apr 2026 07:45:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.167.50 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776843938; cv=pass; b=BCBCRu+4sy2hDhrifaSnTLlFPZJEnoWc987tgHDdixPZ00M/UBAlSEUNE7GDon+YYFQIJEWSfQTpFpti+AHApB5m5x6H9gewSBvPtUV6/e77y0p5ao5usCBt8FuSLlyq/W0vwMHUacB3RXWNacitgjrtPJpwpJMehOb6nWYxAcQ= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776843938; c=relaxed/simple; bh=ZAAxhN8SKNjKA3Up6YyHYbskKLZJ/46kGXKUZ+PsJGw=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=ZJgWEv+iiTEFmNRlp8Rji6orqzgl0r8Et9nCl6yqCgQCNE35rimYXZkG85LQH+RGitadO6He36XWf+kCKWa5Vaa3ljr906yxOHdaPVTznYvRX/Zk9d13IwUFfmVqqh39I/zbhhTir07tFXUh0epWN16uYyZ6oS6ZYl+DFO/60xQ= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ga1v68Ct; arc=pass smtp.client-ip=209.85.167.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ga1v68Ct" Received: by mail-lf1-f50.google.com with SMTP id 2adb3069b0e04-5a40502e63bso4968508e87.0 for ; Wed, 22 Apr 2026 00:45:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1776843936; cv=none; d=google.com; s=arc-20240605; b=JuWj1nZliEVlMk5n/gIvgHGLJrFE2PByTQcinfwHLjp9iDjHmUqYluv6N/Bt7B5hDj ycWxSh22fx4emhayT6giMuWke+G78xU+dIpVW6Mu6iVK0kPHzs+4mJ4J8M3vP81osERA CcutZ8L5UJENIwYZqMWFC1aqUGi7j4nFedR4aVCAdzVgYWJofvlFQrKHA61a8bud42Uj wFmm70O6nUYB2X1r2zpveEyvFDgIWaJSSonW6Vr7DF0vlU2om9cjVxAlacBwm0SJzaDV 7cYZ3XUo+9VlS7OhlJjG+kAirxvGA458JY8BFxiK86X4yXMhUXIRTJ4MCkrnwCnTVrkT HG3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=BVPcvxthxBvBAubnIyiJIG2jV89teRldW0ikd9cKYwA=; fh=llSFujR9KJJjiNf0uIxGqgR0JUH0kg2p3pBlKCTotaE=; b=aLSVqx9LpzAM4B5t+TG3P9BCN6t+ESHYRYRt7Ze2qswPC5C5rtS/2rK2apOSF+hxt6 Pksdhcn84yJ1vZ8Ayd0Tuco02lC0X6tNkzQTW78RKBsknfdu18QPGbab/QtMrJxPKsTW 36hYl3N6GkBndLmanr0FiW75UU0VQjK5iWQHxCxNdTCmMj4E0XyKM9eu0v+mTLbvsBVh nwNnHsDkG5KOdzvo1Qcm93lMqRZQzYI3jzD09PCX2iR13/1YB2xz+44Ap9I7p8Aml4mh GNhCF3e60onZ/RXP6ZK/QLhegv/wfBUelLPEy4UoPlh4hGKQxQG36pdzIy0oSfnH+xe8 o7Dg==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776843936; x=1777448736; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=BVPcvxthxBvBAubnIyiJIG2jV89teRldW0ikd9cKYwA=; b=ga1v68CtOvVy66oh4kSc36GNkmPnfnq6O1GEDeP/5+9gIn2H+aicO+KeBfc72nvidE EFR2iyrFfB3ittnL1i707cZnG+nGQK4n/RqA1d4cddRSuv9uwmZ/q5L8MjSB6w1n/jio HhU865g+EJX7FMFNPrYfwCVsXpv5CU8fHQVUxptVGgKx+l/zxiizPsG2bU04kJTH3w/v 9WmMguQw3p+gEscLOkc5s0/oAw9N2f5VxoDMuI083h1C0RvKK3y+7q/8Q+D1+Zu0VCX2 DzUjA/i3Mvdms8o0w8mBOn9lpMpnWLnDgxORLKB/yPm6VsKRKdZs1KHITMAD5fG0qpRQ plZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776843936; x=1777448736; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=BVPcvxthxBvBAubnIyiJIG2jV89teRldW0ikd9cKYwA=; b=Ja0ga3zzFnAgw0dVNgzHxLvVstxci9CigTXpMltGQW0lTEDJ4zL/vfSSXKTKqB5RGB Tm/TkebMGpnjUQ8Fy3jWzgdn+yWHPOO8pxkhlpnLL/YumN8CSix2kmnUNBRN84tRSguU IVO2yUspWGyAL2Sohk2pNou82dDsBO9C4v1fsKg+4wMWvgNdjDEt6PnmRwnuaL9Fnq2z vVzC3MElTrAvLg2YU3NTViR7jDTlELa+OsKQoEEAd/i5GqFXSHxlApMdlCtZ4Onnara1 +XYoKtohqTB1cHFTxU0q02zyQ6D30qR9FvAgqxXdcgDGlgZX9b94+e0e+KvX+/7EJqvj 8L8w== X-Forwarded-Encrypted: i=1; AFNElJ9nBmvPF1gMsVzYFXwi9V9S+e46L/WfO5Ej8mYuL76NA1lq8wOO0C+oGxuB7eyHsMnA68RaS9RO6vrzJKE=@vger.kernel.org X-Gm-Message-State: AOJu0YyygPLekq9sHm2jGemXZinCZwxxoLovpdD2k29Jc5dOgseTU9zT ooTjRkF4FTkIptaLLL4FLn8h/ZVj7debVG6dfeeUqZRRVy7INd08wSIkU8Glv+FT5/N8tYCfCY8 oZLcw19pCKru0RTt3VswDjzJ/5HiGFWY= X-Gm-Gg: AeBDiesF5nJIk95vdbp5ibLrxFEQfdGOQel5aLPmrwlkxhTSAGCoW4vKfHX0h0DjKE9 g97Zgpba2y1fHKN++u46875gN2DPwLngILYyXBaU28GFM3UnhB54iN/5lG+xUzKiZseuKvspw05 KHHeeB2xh2S/3cUlwLHHb/2R6t/AAGFgmPzlYuxt/o3hG3/1Yyc2PvdQWLArPty4ppHDWpYK0Fu GgXiFkcQrx+O6IK2GBpQTM8drI2RDyXKPvelQ6HeZ/H/zsoAzV6xZ/giItRtBKou8L0Vdybm4pc UVi6mfkkuJ1mK4JpYjwsrZTDPP50 X-Received: by 2002:a05:6512:1086:b0:5a1:1b06:7e81 with SMTP id 2adb3069b0e04-5a4172eac71mr6549450e87.42.1776843935222; Wed, 22 Apr 2026 00:45:35 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260422030543.125743-1-zhanxusheng@xiaomi.com> In-Reply-To: <20260422030543.125743-1-zhanxusheng@xiaomi.com> From: Hyunchul Lee Date: Wed, 22 Apr 2026 16:45:23 +0900 X-Gm-Features: AQROBzA9uud6i02KQjrblJbQnrOxy7-FdhIl0HlLi08M8YZ_StAC_-z9HLdDHzI Message-ID: Subject: Re: [PATCH] ntfs: fix s64 overflow in ntfs_mapping_pairs_decompress() To: Zhan Xusheng Cc: Namjae Jeon , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Zhan Xusheng Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello Zhan, 2026=EB=85=84 4=EC=9B=94 22=EC=9D=BC (=EC=88=98) =EC=98=A4=ED=9B=84 12:08, = Zhan Xusheng =EB=8B=98=EC=9D=B4 =EC=9E=91=EC=84= =B1: > > In ntfs_mapping_pairs_decompress(), deltaxcn is decoded from the > on-disk mapping pairs array and negative values are rejected, but > large positive values up to S64_MAX pass through unchecked. The > subsequent `vcn +=3D deltaxcn` can then wrap the s64 accumulator to a > negative value, breaking the monotonically-increasing VCN invariant > that ntfs_rl_vcn_to_lcn() and related helpers rely on. > > A crafted NTFS image with a single 8-byte run-length of S64_MAX > triggers this when lowest_vcn > 0, leading to incorrect LCN lookups > and potential reads/writes to wrong disk sectors. > > Add an overflow check before the addition and treat the on-disk data > as corrupt (-EIO) when the result would exceed S64_MAX. > > Signed-off-by: Zhan Xusheng > --- > fs/ntfs/runlist.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c > index b213b4976d2b..a32affb57d29 100644 > --- a/fs/ntfs/runlist.c > +++ b/fs/ntfs/runlist.c > @@ -823,7 +823,16 @@ struct runlist_element *ntfs_mapping_pairs_decompres= s(const struct ntfs_volume * > * element. > */ > rl[rlpos].length =3D deltaxcn; > - /* Increment the current vcn by the current run length. *= / > + /* > + * Increment the current vcn by the current run length. > + * Both are non-negative here; guard against s64 overflow > + * from a crafted mapping pairs array to preserve the > + * monotonically-increasing vcn invariant. > + */ > + if (unlikely(deltaxcn > S64_MAX - vcn)) { > + ntfs_error(vol->sb, "VCN overflow in mapping pair= s array."); > + goto err_out; > + } > vcn +=3D deltaxcn; Could you use check_add_overflow() here? In addition, attr->data.non_resident.lowest_vcn also needs to be validated with overflows_type(). > /* > * There might be no lcn change at all, as is the case fo= r > -- > 2.43.0 > > --=20 Thanks, Hyunchul