In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass<\/p>\n
In log_replay()’s analysis pass, after find_dp() returns a
\nvalid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple,
\nthe copy_lcns block walks lrh->lcns_follow further entries:<\/p>\n
\tt16 = le16_to_cpu(lrh->lcns_follow);
\n\tfor (i = 0; i target_vcn) –
\n\t le64_to_cpu(dp->vcn));
\n\t dp->page_lcns[j + i] = lrh->page_lcns[i];
\n\t}<\/p>\n
find_dp() only validates that target_vcn falls within
\n[dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST
\ncluster is covered. The walk through the further entries is
\nnot bounded against dp->lcns_follow. For a malformed LRH
\nwhere target_vcn = dp->vcn + dp->lcns_follow – 1 and
\nlrh->lcns_follow > 1, the i > 0 writes overflow the dp’s
\nallocated page_lcns[] array.<\/p>\n
Add the missing j + lrh->lcns_follow lcns_follow guard.<\/p>\n
Reproduced under UML+KASAN on mainline 8d90b09e6741 as a
\nslab-out-of-bounds write of size 8 from log_replay+0x68d4 on
\nthe mount path.<\/p>\n
This is distinct from Pavitra Jha’s 2026-05-02 patch
\n(“fs\/ntfs3: validate lcns_follow in log_replay conversion”,
\n) which
\naddresses the separate version-0 dirty-page-table conversion
\npath’s memmove(&dp->vcn, …) call. The two fixes are
\ncomplementary; both should land.<\/p>\n
[almaz.alexandrovich@paragon-software.com: clang-formatted the changes,
\nfixed conflicts]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass<\/p>\n
In log_replay()’s analysis pass, after find_dp() returns a
\nvalid <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6827","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}