From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lf1-f43.google.com (mail-lf1-f43.google.com [209.85.167.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 528D317745 for ; Mon, 27 Apr 2026 00:18:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.167.43 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777249135; cv=pass; b=LZVXvvV3rtfZwOwdApDU7AxRRg3ugNmmzN6xc0Y74VUHBitfvUnIvNGj8ZCZBFUvTqEgx5X54R8OKrrruvQ3ROqKR6SchWN4wBkjC92GW4CklUfEnbe8oMGk9tC3tx/mosUVlWawA56mKLcGVahoT46PxL6OLTlXdgPDwnXOuC8= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777249135; c=relaxed/simple; bh=xwTxbtCfJM8uIKEUDjEeO3vL53GITPmvVDKzPnWdcBQ=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=mn1hge4VkhSPd0b4DEkLPI7p8ZCjE0ow/4NHM0C+h8bk0YKrFZYgykxRXe5ZCKS19aua3g2MGkAMP21nwNm0mpgXP79RXRZd9xVHqeynDVLuQZSfIL1s5FS/ztP5t99AliX9pWfZg7fVSkIkgKIC9pKDGH0ZR9bYv//kiBSPUG0= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Y4SvY92i; arc=pass smtp.client-ip=209.85.167.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Y4SvY92i" Received: by mail-lf1-f43.google.com with SMTP id 2adb3069b0e04-5a40d02b58bso8313075e87.3 for ; Sun, 26 Apr 2026 17:18:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1777249133; cv=none; d=google.com; s=arc-20240605; b=RpZEaHrN1RaSvke/TNzl3V2WXKaKb4f020Hd2mHgt+iD/whatCSOX+UCYeTqCRWA7C D65g5RVWzFEyAiuBknUZnqAGqqkngocHL3I38qzZePD7gue8vBkgmlBE/LUAJrTNS+0u XdnnpniW9QsrvvSy8qjbbEiBxfoox/aGQWL7HC0qYyK4dJMsChv70Gkw7AmfIJYU/8zc 72ezbal8TLgMa3VBF0hpNOWHTiOzJvSyzVqU5rLvXvsLVAWB3rMqlxKVeZs+g+cB7r9y G3ytXwETA5mb7GHcqo6RYxct3GO0B5yIzyVxg7gkLw0EQvo3scO2QvS9sCnfqwVNDF/f YMmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=Xx8r2Q1xe16f1xw6CnBY95tDvnZrCwCMslwUSCLdWNU=; fh=Iskt3BrxxSKGrMjnsQ32muASuZLprt6FKTCA1dpHKCM=; b=hFzfwJDzwKDY5I+FZEN1VwlrfFJLsVbigyYZm5SlDugT9an8YFgaQfWNhzid3Gl7Pe KV5j5ZcoCZ1N748GXAMrQRok+M16fuHVPcwYSAcILtItjIsKBDDbGzWvnakX9HuivPW0 ehC36XkbvbKx9cZTCz8O31p/wUqdz7Po9LnPKg0nIffEBrQQp+aZPnLuPTntbY4QZ/UX 4d4miImNjj/hNjHLSxyEpnKIHvKppwoaoMmL4h7Dg/4ZYde6Slmzb+ScrCM0YMmqUTkV bQH+u4i8czTZirjBl/5QpMFvyd4N0MWErFtRzOa4Ga1kJy9E+h2QenwZtn0Uq+s14geT pwhA==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777249133; x=1777853933; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=Xx8r2Q1xe16f1xw6CnBY95tDvnZrCwCMslwUSCLdWNU=; b=Y4SvY92iVyUvsWix3UCHPXkY+plwYAxEr5aNccB4g5KhbsH1tCjZBmv75wmSdAh+Oj Tn1S0Wrlm1s1Wi/uEN1MIjhN02xkrdSSRSem4RISJrKD5MhMzV5KfRxKjT4rm+As+DQt fwJ8gL8lHO8xuQMoeA+Ygy2XWSJApaieU7UjHsYrpb4iFzTERZEdGw/z+EiakajzLW9A WiOUEhhNjquYsSsYDgaQ907Iep+GaC/VkH3Vw4rwYimI6Vt7kxBo3EVFPGG8EzD3tc0A RyRMtrIL60wb/FSX8fG3bOv7k71hcfNrrOy3+AffzBTinLDkF0aZreHZz35eV7m8+/5U oN5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777249133; x=1777853933; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Xx8r2Q1xe16f1xw6CnBY95tDvnZrCwCMslwUSCLdWNU=; b=SSveR43UujqCaPXIqMvdCrQVaev5APrgqBYE+GIo3RoGaAwnV4zP32gl3leEU7SFCk QW1b6IIwwxOoZRz8gL6ww4QiKNHXCfjIyKrVkFZw9eP8VHzyharmEy3QqxTAy+ABTxbP AXdWxMPnbXtitbr5om0yKFoiJpCYzcVzZk5/DajS5EYdjRRhTpDCf5BXitpNg+MgfBRG bM5BV3YiSQOXLRp9VARgrieGaCsMo0jZ0w1rFqUHMDZopezj+pR3RnOJRxYjyj1uaCu3 7qevxl9drkJE646+ODqt5E6ilbo7MiYA1UccjtEXhy2BZxnQqf63im/BrwGfklWnGm+K J2ig== X-Forwarded-Encrypted: i=1; AFNElJ9obnB/FZZ7o7Fmt2Nt5bJC9GxzirTnJnFv7gA49dda13/yaY9bFc4+uvBHKnB4T1cfpBDbMBn9F/wMp/Y=@vger.kernel.org X-Gm-Message-State: AOJu0Yy7HEo0dO5ALKx3/r91/LR8tK9vVdYh3nMLfj2/v0r/erNXuhnl VFhnvAZbKPvO8OzHBBMNS/uvu+CVJKqJa+JwW3Px4YjLo0vs7OrVr2YxjBBlLwMbQVs15k0wKhN hTyceF2Dvh7OIo8dqbBLdWf31VPWqoDY= X-Gm-Gg: AeBDievcnzI7EdElkXzEq9ZDNwEFrxhOYOOc2WfuvdytZOa001lcvm/NBosV4WnnRlY b62uKAVXsGBGdkHUlwGWqs2629b50Oeqyg8W2rqbOeSPIXT3duTvYVhm1eoOWXdUVRFtlWQTY5+ sEzlnPDGXLPr2Ih03d61StfSWTYvE9izIPYnPJm1oy+CD46Te6TebVdCY2VBEmzpmdy2X3NOJ52 XzZtSycGGV/znA29Xh6ejiyzhG0sAGCZgkrYXJ233wnq3LG7XTgNIfkrA8rZY6kTVnngYxdbOxf +JTLFTud7V3BTkCf5w== X-Received: by 2002:a05:6512:3dab:b0:5a3:d2ef:2f9f with SMTP id 2adb3069b0e04-5a4172da1ddmr13072116e87.20.1777249132325; Sun, 26 Apr 2026 17:18:52 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260422094737.194069-1-zhanxusheng@xiaomi.com> In-Reply-To: From: Hyunchul Lee Date: Mon, 27 Apr 2026 09:18:38 +0900 X-Gm-Features: AVHnY4IfCGZn0fz60WB_oIVLPhsd4BNa0n_eWar6dthlsTBZy5px0Yzv_c-fwX8 Message-ID: Subject: Re: [PATCH v2] ntfs: fix VCN overflow in ntfs_mapping_pairs_decompress() To: Zhan Xusheng Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Zhan Xusheng , Namjae Jeon Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable 2026=EB=85=84 4=EC=9B=94 23=EC=9D=BC (=EB=AA=A9) =EC=98=A4=EC=A0=84 8:57, H= yunchul Lee =EB=8B=98=EC=9D=B4 =EC=9E=91=EC=84=B1: > > 2026=EB=85=84 4=EC=9B=94 22=EC=9D=BC (=EC=88=98) =EC=98=A4=ED=9B=84 6:47,= Zhan Xusheng =EB=8B=98=EC=9D=B4 =EC=9E=91=EC=84= =B1: > > > > In ntfs_mapping_pairs_decompress(), lowest_vcn is read from > > on-disk metadata and used as the initial vcn without validation. > > A malformed value can introduce an invalid (e.g. negative) vcn, > > corrupting the runlist from the start. > > > > Additionally, the accumulation > > vcn +=3D deltaxcn > > > > does not check for s64 overflow. A crafted mapping pairs array > > can wrap vcn to a negative value, breaking the monotonically- > > increasing invariant relied upon by ntfs_rl_vcn_to_lcn() and > > related helpers. > > > > Fix this by validating lowest_vcn and using check_add_overflow() > > for vcn accumulation. > > > > Signed-off-by: Zhan Xusheng > > --- > > v2: > > - Validate lowest_vcn from on-disk metadata > > - Use check_add_overflow() for vcn accumulation > > --- > > fs/ntfs/runlist.c | 19 +++++++++++++++++-- > > 1 file changed, 17 insertions(+), 2 deletions(-) > > > > diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c > > index b213b4976d2b..ee68258ebffb 100644 > > --- a/fs/ntfs/runlist.c > > +++ b/fs/ntfs/runlist.c > > @@ -749,6 +749,12 @@ struct runlist_element *ntfs_mapping_pairs_decompr= ess(const struct ntfs_volume * > > #endif > > /* Start at vcn =3D lowest_vcn and lcn 0. */ > > vcn =3D le64_to_cpu(attr->data.non_resident.lowest_vcn); > > + /* Validate lowest_vcn from on-disk metadata to ensure it is sa= ne. */ > > + if (unlikely(vcn < 0)) { > > + ntfs_error(vol->sb, "Invalid lowest_vcn in mapping pair= s."); > > + goto err_out; > > + } > > How about using overflows_type() ? > And please include . Just a gentle ping. Please let me know your thoughts. > > > + > > lcn =3D 0; > > /* Get start of the mapping pairs array. */ > > buf =3D (u8 *)attr + > > @@ -823,8 +829,17 @@ struct runlist_element *ntfs_mapping_pairs_decompr= ess(const struct ntfs_volume * > > * element. > > */ > > rl[rlpos].length =3D deltaxcn; > > - /* Increment the current vcn by the current run length.= */ > > - vcn +=3D deltaxcn; > > + /* > > + * Increment the current vcn by the current run length. > > + * Guard against s64 overflow from a crafted mapping > > + * pairs array to preserve the monotonically-increasing > > + * vcn invariant. > > + */ > > + if (unlikely(check_add_overflow(vcn, deltaxcn, &vcn))) = { > > + ntfs_error(vol->sb, "VCN overflow in mapping pa= irs array."); > > + goto err_out; > > + } > > + > > /* > > * There might be no lcn change at all, as is the case = for > > * sparse clusters on NTFS 3.0+, in which case we set t= he lcn > > -- > > 2.43.0 > > > > > -- > Thanks, > Hyunchul --=20 Thanks, Hyunchul