Re: red zone violation in ntfs_runlists_merge()

Hi Robert,

I have submitted a patch for this issue:

https://lore.kernel.org/all/[email protected]/

2026년 8월 17일 (월) 오전 4:06, <[email protected]>님이 작성:
>
> The following mounts a corrupt NTFS image that produces a red zone
> violation:
>
> # uname -a
> Linux xxx 7.2.0-rc7-00016-g3d6d817622b0 #40 SMP PREEMPT_DYNAMIC Wed Aug 12 13:01:40 EDT 2026 x86_64 x86_64 x86_64 GNU/Linux
> # wget http://www.rtmrtm.org/rtm/ntfs2b.img.gz
> # gunzip ntfs2b.img.gz
> mount -t ntfs -o loop ntfs2b.img /mnt
> [Right Redzone overwritten] 0xffff888100321300-0xffff888100321307 @offset=4864.
> ...
>
> The overrun occurs in the last three lines of this code in
> ntfs_runlists_merge():
>
>                         drl[ds].length = marker_vcn - drl[ds].vcn;
>                         /* Finally add the ENOENT terminator. */
>                         ds++;
>                         if (!slots) {
>                                 drl = ntfs_rl_realloc_nofail(drl, ds, ds + 1);
>                                 rtm_check(drl);
>                                 *new_rl_count += 1;
>                         }
>                         drl[ds].vcn = marker_vcn;
>                         drl[ds].lcn = LCN_ENOENT;
>                         drl[ds].length = (s64)0;
>
> After the ds++, ds is too large, but slots == 1.
>
> Robert Morris
> [email protected]
>


-- 
Thanks,
Hyunchul