Tobias Gaertner 60dab3e293 ntfs3: fix integer overflow in run_unpack() volume boundary check ...

commit 984a415f01 upstream.

The volume boundary check `lcn + len > sbi->used.bitmap.nbits` uses raw
addition which can wrap around for large lcn and len values, bypassing
the validation.  Use check_add_overflow() as is already done for the
adjacent prev_lcn + dlcn and vcn64 + len checks added by commit
3ac37e1003 ("ntfs3: Fix integer overflow in run_unpack()").

Found by fuzzing with a source-patched harness (LibAFL + QEMU).

Fixes: 82cae269cf ("fs/ntfs3: Add initialization of super block")
Cc: stable@vger.kernel.org
Signed-off-by: Tobias Gaertner <tob.gaertner@me.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-05-07 06:09:42 +02:00

..

lib

…

attrib.c

fs/ntfs3: drop preallocated clusters for sparse and compressed files

2026-03-04 07:21:27 -05:00

attrlist.c

fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST

2026-03-04 07:21:27 -05:00

bitfunc.c

…

bitmap.c

fs/ntfs3: Fix a resource leak bug in wnd_extend()

2025-10-19 16:33:49 +02:00

debug.h

…

dir.c

fs/ntfs3: Add sanity check for file name

2025-08-20 18:30:21 +02:00

file.c

fs/ntfs3: prevent infinite loops caused by the next valid being the same

2026-03-04 07:20:34 -05:00

frecord.c

ntfs: Do not overwrite uptodate pages

2026-01-08 10:14:37 +01:00

fslog.c

fs/ntfs3: validate rec->used in journal-replay file record check

2026-04-27 07:24:24 -06:00

fsntfs.c

fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra()

2026-03-04 07:21:27 -05:00

index.c

fs: ntfs3: check return value of indx_find to avoid infinite loop

2026-03-04 07:21:26 -05:00

inode.c

fs/ntfs3: Initialize allocated memory before use

2026-01-30 10:28:48 +01:00

Kconfig

…

lznt.c

…

Makefile

…

namei.c

…

ntfs_fs.h

fs/ntfs3: Support timestamps prior to epoch

2026-01-08 10:13:56 +01:00

ntfs.h

…

record.c

…

run.c

ntfs3: fix integer overflow in run_unpack() volume boundary check

2026-05-07 06:09:42 +02:00

super.c

ntfs: set dummy blocksize to read boot_block when mounting

2026-01-08 10:13:56 +01:00

upcase.c

…

xattr.c

…