For the cluster bitmap ($Bitmap), __ntfs_bitmap_set_bits_in_run() uses a cluster number as an index into vol->lcn_empty_bits_per_page[] via ntfs_set_lcn_empty_bits(), with no upper bound on the index.  On the deallocation path that cluster number is read from an on-disk runlist, so a corrupted runlist naming a cluster beyond the end of the volume writes past the end of the array into adjacent memory when a file is freed. Reject cluster ranges outside the volume before updating the array, mirroring the nr_clusters check already used in ntfs_trim_fs(). Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Dennis Tighe ---  fs/ntfs/bitmap.c | 15 +++++++++++++++  1 file changed, 15 insertions(+) diff --git a/fs/ntfs/bitmap.c b/fs/ntfs/bitmap.c index b1436b3..fb65bce 100644 --- a/fs/ntfs/bitmap.c +++ b/fs/ntfs/bitmap.c @@ -138,6 +138,21 @@ int __ntfs_bitmap_set_bits_in_run(struct inode *vi, const s64 start_bit,      if (start_bit < 0 || cnt < 0 || value > 1)          return -EINVAL; +    /* +     * For $Bitmap, @start_bit is a cluster number that comes from an +     * on-disk runlist on the free path.  A corrupt runlist can name a +     * cluster past the end of the volume and index +     * vol->lcn_empty_bits_per_page[] out of bounds below, so reject it. +     */ +    if (ni->mft_no == FILE_Bitmap && +        (start_bit >= vol->nr_clusters || cnt > vol->nr_clusters - start_bit)) { +        ntfs_error(vi->i_sb, +               "Cluster range (0x%llx+0x%llx) outside volume 0x%llx; corrupt runlist.", +               (unsigned long long)start_bit, (unsigned long long)cnt, +               (unsigned long long)vol->nr_clusters); +        return -EIO; +    } +      /*       * Calculate the indices for the pages containing the first and last       * bits, i.e. @start_bit and @start_bit + @cnt - 1, respectively. -- 2.47.3