Re: [PATCH v2] ntfs: reject invalid MFT LCNs from boot sector
Namjae Jeon <[email protected]>
| Newsgroups | dev.linux.lists.ntfs,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <CAKYAXd9vGE3pLjEfamqjr0unkxfyHzySC7nMwRb+xheMOjV7Pw@mail.gmail.com> |
On Wed, Aug 19, 2026 at 4:19 PM Hyunchul Lee <[email protected]> wrote: > > The NTFS boot sector stores the MFT and MFTMirr locations as unsigned > 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64. > A crafted high-bit value could therefore become negative and pass > the existing upper-bound check. The invalid value then propagated into > the MFT zone allocator and could result in an out-of-bounds access to > lcn_empty_bits_per_page. > > Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator") > Reported-by: Robert Morris <[email protected]> > Closes: https://lore.kernel.org/all/57514.1787000602@localhost > Cc: [email protected] > Signed-off-by: Hyunchul Lee <[email protected]> Applied it to #ntfs-next. Thanks!