From c1bd2f1c22c2fa8c5f0f51f82afad23f2dd1bcf1 Mon Sep 17 00:00:00 2001 From: pwngets <2605452642@qq.com> Date: Wed, 23 Sep 2026 13:41:06 +0800 Subject: [PATCH] ntfs: fix runlist marker allocation and count The marker path can append an unmapped element and an ENOENT terminator after the merge helpers have already computed the resulting runlist count. In that case, allocating ds + 2 elements leaves no room for the terminator at ds + 2. The path also increments new_rl_count even though the merge helper already accounted for the final runlist size, causing a later merge to start past the terminator. Allocate space through ds + 2, and derive new_rl_count from the final terminator index instead of incrementing the count a second time. A crafted NTFS image can reach this path through a normal read after the image has been mounted and trigger out-of-bounds kernel heap accesses. Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator") Assisted-by: OpenAI Codex:GPT-5 Signed-off-by: pwngets <2605452642@qq.com> Reviewed-by: Baolin Liu Signed-off-by: Namjae Jeon --- fs/ntfs/runlist.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c index 3a61f19bcbee..f13d28c15887 100644 --- a/fs/ntfs/runlist.c +++ b/fs/ntfs/runlist.c @@ -680,9 +680,8 @@ struct runlist_element *ntfs_runlists_merge(struct runlist *d_runlist, /* Add an unmapped runlist element. */ if (!slots) { drl = ntfs_rl_realloc_nofail(drl, ds, - ds + 2); + ds + 3); slots = 2; - *new_rl_count += 2; } ds++; /* Need to set vcn if it isn't set already. */ @@ -698,11 +697,11 @@ struct runlist_element *ntfs_runlists_merge(struct runlist *d_runlist, ds++; if (!slots) { drl = ntfs_rl_realloc_nofail(drl, ds, ds + 1); - *new_rl_count += 1; } drl[ds].vcn = marker_vcn; drl[ds].lcn = LCN_ENOENT; drl[ds].length = (s64)0; + *new_rl_count = ds + 1; } } }