kernel/git/next/linux-next.git/fs/ntfs/dir.c, branch fs-current

ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()

2026-07-06T11:27:16+00:00

ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an error-marked MFT reference to its callers without validating it. Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image can set the MREF error bit while leaving the low bits as an arbitrary value, causing callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata. Fix this at the source by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to all four directory lookup return paths so every caller gets a validated result without needing additional checks or an API change. This keeps the sanitization in the common lookup helper, which is cleaner than duplicating validation in each caller. Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"") Cc: stable@vger.kernel.org Reported-by: Hongling Zeng Signed-off-by: Namjae Jeon

ntfs: validate index entries on reading

2026-06-05T15:19:56+00:00

Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in those paths. Cc: stable@vger.kernel.org # v7.1 Tested-by: woot000 Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: validate index block header more strictly

2026-06-05T15:19:52+00:00

Modify ntfs_index_block_inconsisent() to perform stricter validation of INDEX_HEADER geometry in INDX blocks, and update ntfs_lookup_inode_by_name() to use that function to validate INDX blocks. Cc: stable@vger.kernel.org # v7.1 Tested-by: woot000 Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: fix NULL dereference in ntfs_index_walk_down()

2026-04-27T13:29:04+00:00

ntfs_index_walk_down() allocates ictx->ib when descending from the root into an index allocation block. If that allocation fails, the old code still passes the NULL buffer to ntfs_ib_read(), which can write through it via ntfs_inode_attr_pread(). Allocate the index block into a temporary pointer and return -ENOMEM before changing the index context on allocation failure. Also propagate ERR_PTR() through ntfs_index_next() and ntfs_readdir() so walk-down allocation or index block read failures are not mistaken for normal index iteration inside the filesystem. ntfs_readdir() keeps the existing userspace-visible behavior of suppressing readdir errors after marking end_in_iterate; this change only prevents the walk-down failure path from dereferencing NULL internally. The failure was reproduced with failslab fail-nth injection on getdents64; the original module hits a NULL pointer dereference in memcpy_orig through ntfs_ib_read(), while the patched module reaches the same ntfs_index_walk_down() allocation failure without crashing. Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: fix variable dereferenced before check warnings

2026-03-16T11:27:45+00:00

Detected by Smatch. lcnalloc.c:736 ntfs_cluster_alloc() error: we previously assumed 'rl' could be null (see line 719) inode.c:3275 ntfs_inode_close() warn: variable dereferenced before check 'tmp_nis' (see line 3255) attrib.c:4952 ntfs_attr_remove() warn: variable dereferenced before check 'ni' (see line 4951) dir.c:1035 ntfs_readdir() error: we previously assumed 'private' could be null (see line 850) Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: prefer IS_ERR_OR_NULL() over manual NULL check

2026-03-16T11:27:42+00:00

Use IS_ERR_OR_NULL() instead of manual NULL and IS_ERR() checks. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: use ->mft_no instead of ->i_ino in prints

2026-03-06T13:08:42+00:00

This improves log accuracy for NTFS debugging and removes unnecessary reliance on the VFS i_ino field ahead of the core VFS type change. Signed-off-by: Namjae Jeon

ntfs: change mft_no type to u64

2026-03-06T13:08:39+00:00

Changes the type of ntfs_inode::mft_no from unsigned long to u64 to safely handle the full 48-bit range without truncation risk, especially in preparation for broader VFS inode number type (i_ino:u64) and to improve consistency with ntfs driver practices. Signed-off-by: Namjae Jeon

ntfs: update directory operations

2026-02-19T12:48:07+00:00

Update the directory and index operations to support full read-write functionality and use the folio API, including directory modification. Acked-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Namjae Jeon

Revert "fs: Remove NTFS classic"

2026-02-19T12:48:05+00:00

This reverts commit 7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89. Reverts the removal of the classic read-only ntfs driver to serve as the base for a new read-write ntfs implementation. If we stack changes on top of the revert patch, It will significantly reduce the diff size, making the review easier. This revert intentionally excludes the restoration of Kconfig and Makefile. The Kconfig and Makefile will be added back in the final patch of this series, enabling the driver only after all features and improvements have been applied. Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon