Re: [BUG REPORT] ntfs: use-after-free read of the runlist in ntfs_rl_vcn_to_lcn() (FIBMAP vs concurrent write)

[Namjae Jeon]

On Mon, Oct 12, 2026 at 6:45 PM 1sh1ro <yangguikun19@xxxxxx> wrote:
>
> Hi Namjae, Hyunchul,
>
> another crafted-image bug from the same fuzzing campaign as the ntfs_ie_add()
> NULL dereference I sent earlier today: an ioctl(FIBMAP) racing with a write on
> the same file in a mounted NTFS image reads a runlist array that the write
> path has already freed.
Can you check if the following patch fixes this issue ?

https://web.git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs.git/commit/?id=e29de9195f6424a3728580e836c32f80e94d2254

Thanks.