DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 5368B606A335
To: Namjae Jeon <linkinjeon@kernel.org>,
    Hyunchul Lee <hyc.lee@gmail.com>
cc: ntfs@lists.linux.dev
From: rtm@csail.mit.edu
Reply-To: rtm@csail.mit.edu
Subject: huge VCN in ntfs can result in a kernel page fault
Date: Tue, 27 Oct 2026 07:25:44 -0400
Message-ID: <10091.1793100344@localhost>
Precedence: list

If the 64-bit VCN in an index entry would have the the high bit set if
shifted left by icx->vcn_size_bits, ntfs_index_walk_down() will pass
that vcn to ntfs_ib_read(), which shifts it left and passes it (via pos)
to ntfs_inode_attr_pread(), which checks s64 pos for too big but not too
small:

        if (pos > isize) {
                mutex_unlock(&mrec_ni->mrec_lock);
                return -EINVAL;
        }

and then passes a bad pointer to memcpy() (line 3801 of ntfs/inode.c):

                memcpy(buf, (u8 *)attr + pos, count);

# wget http://www.rtmrtm.org/rtm/ntfs23g.img.gz
# gunzip ntfs23g.img.gz 
# mount -t ntfs -o loop,rw ntfs23g.img /mnt
# ls -l /mnt
ntfs: (device loop0): ntfs_lookup_inode_by_name(): Corrupt directory.  Aborting lookup.
ntfs: (device loop0): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys.
ntfs: (device loop0): load_system_files(): Failed to determine if Windows is hibernated.  Mounting read-only.  Run chkdsk.
Oops: general protection fault, probably for non-canonical address 0x7fffc039131f1c50: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
CPU: 4 UID: 0 PID: 1475 Comm: ls Not tainted 7.3.0-16472-gd135ab453a74 #46 PREEMPT(full)
Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021
RIP: 0010:memcpy_orig+0x16/0x140
Code: 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 f8 48 83 fa 20 72 7e 40 38 fe 7c 35 48 83 ea 20 48 83 ea 20 <4c> 8b 06 4c 8b 4e 08 4c 8b 56 10 4c 8b 5e 18 48 8d 76 20 4c 89 07
RSP: 0018:ffffc90000b27ce8 EFLAGS: 00010206
RAX: ffff888104869000 RBX: 800037b810010000 RCX: ffff8881056fa140
RDX: 0000000000000fc0 RSI: 7fffc039131f1c50 RDI: ffff888104869000
RBP: ffffc90000b27d48 R08: ffff8881056fa140 R09: 0000000000000000
R10: 0000000000000018 R11: ffffffff817f16b6 R12: 0000000000000000
R13: ffff888104869000 R14: ffff8881056fa140 R15: 0000000000001000
FS:  00007fe46c7a5800(0000) GS:ffff8884aa47e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005646e478fb68 CR3: 0000000108cd4001 CR4: 00000000003706f0
Call Trace:
 <TASK>
 ? ntfs_inode_attr_pread+0x33c/0x410
 ntfs_ib_read+0x5f/0xf0
 ntfs_index_walk_down+0x76/0x120
 ntfs_readdir+0x8ae/0xba0
 ? selinux_file_permission+0x127/0x190
 iterate_dir+0x80/0x190
 __x64_sys_getdents64+0x77/0x110
 ? __pfx_filldir64+0x10/0x10
 x64_sys_call+0x96b/0x2220
 do_syscall_64+0xdd/0x4a0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Robert Morris
rtm@mit.edu