kernel/git/stable/linux.git/fs/ntfs3/dir.c, branch linux-7.2.y

ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()

2026-06-02T15:02:40+00:00

The bounds check in ntfs_dir_emit() compares fname->name_len (a character count) against e->size (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size: if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)) This computes: name_len + 16 > e_size The correct check must account for the ATTR_FILE_NAME header (66 bytes before the name) and the UTF-16LE character size (2 bytes each): sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) + name_len * sizeof(short) > e_size Which computes: 16 + 66 + name_len * 2 > e_size The correct calculation already exists as fname_full_size() in ntfs.h and is used in cmp_fnames(), namei.c, and fslog.c, but was not used in the readdir path. A crafted NTFS image with an index entry containing a small e->size but large fname->name_len bypasses the current check, causing ntfs_utf16_to_nls() to read past the entry boundary. Additionally, add a key_size validation in hdr_find_e() to ensure the declared key_size does not exceed the available entry data, preventing comparison functions from reading past entry boundaries on the lookup path. Signed-off-by: Alessandro Schino <7991aleschino@gmail.com> Signed-off-by: Konstantin Komarov

fs/ntfs3: hold ni_lock across readdir metadata walk

2026-06-02T15:02:24+00:00

[BUG] KASAN reports a slab-use-after-free during getdents(2): BUG: KASAN: slab-use-after-free in ntfs_read_mft fs/ntfs3/inode.c:79 [inline] BUG: KASAN: slab-use-after-free in ntfs_iget5+0x59b/0x3450 fs/ntfs3/inode.c:541 Read of size 2 at addr ffff88800b7a5a4e by task syz.0.1061/2354 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 __asan_report_load2_noabort+0x14/0x30 mm/kasan/report_generic.c:379 ntfs_read_mft fs/ntfs3/inode.c:79 [inline] ntfs_iget5+0x59b/0x3450 fs/ntfs3/inode.c:541 ntfs_dir_emit fs/ntfs3/dir.c:337 [inline] ntfs_read_hdr+0x714/0x930 fs/ntfs3/dir.c:385 ntfs_readdir+0xaad/0x1010 fs/ntfs3/dir.c:458 iterate_dir+0x276/0x9e0 fs/readdir.c:108 __do_sys_getdents fs/readdir.c:326 [inline] __se_sys_getdents fs/readdir.c:312 [inline] __x64_sys_getdents+0x143/0x290 fs/readdir.c:312 ... Allocated by task 2160: kasan_save_stack+0x39/0x70 mm/kasan/common.c:56 kasan_save_track+0x14/0x40 mm/kasan/common.c:77 kasan_save_alloc_info+0x37/0x60 mm/kasan/generic.c:573 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0xc3/0xd0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5650 [inline] __kmalloc_noprof+0x2bd/0x900 mm/slub.c:5662 kmalloc_noprof include/linux/slab.h:961 [inline] mi_init+0x9d/0x110 fs/ntfs3/record.c:105 mi_format_new+0x6b/0x500 fs/ntfs3/record.c:422 ni_add_subrecord+0x129/0x540 fs/ntfs3/frecord.c:321 ntfs_look_free_mft+0x238/0xd90 fs/ntfs3/fsntfs.c:715 ni_create_attr_list+0x8e6/0x1690 fs/ntfs3/frecord.c:826 ni_ins_attr_ext+0x5ec/0x9d0 fs/ntfs3/frecord.c:924 ni_insert_attr+0x2bf/0x830 fs/ntfs3/frecord.c:1091 ni_insert_resident+0xec/0x3d0 fs/ntfs3/frecord.c:1475 ni_add_name+0x4b2/0x8a0 fs/ntfs3/frecord.c:2987 ni_rename+0xa6/0x160 fs/ntfs3/frecord.c:3026 ntfs_rename+0xa19/0xe00 fs/ntfs3/namei.c:332 vfs_rename+0xd42/0x1d50 fs/namei.c:5216 do_renameat2+0x715/0xb60 fs/namei.c:5364 __do_sys_rename fs/namei.c:5411 [inline] __se_sys_rename fs/namei.c:5409 [inline] __x64_sys_rename+0x83/0xb0 fs/namei.c:5409 x64_sys_call+0x8c4/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:83 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 85: kasan_save_stack+0x39/0x70 mm/kasan/common.c:56 kasan_save_track+0x14/0x40 mm/kasan/common.c:77 __kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x6f/0xa0 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2543 [inline] slab_free mm/slub.c:6642 [inline] kfree+0x2bf/0x6b0 mm/slub.c:6849 mi_clear fs/ntfs3/ntfs_fs.h:1107 [inline] mi_put+0x10e/0x1a0 fs/ntfs3/record.c:97 ni_write_inode+0x479/0x2a00 fs/ntfs3/frecord.c:3320 ntfs3_write_inode+0x51/0x70 fs/ntfs3/inode.c:1042 write_inode fs/fs-writeback.c:1564 [inline] __writeback_single_inode+0x8c9/0xc30 fs/fs-writeback.c:1784 writeback_sb_inodes+0x5e6/0xf60 fs/fs-writeback.c:2015 __writeback_inodes_wb+0x10c/0x2d0 fs/fs-writeback.c:2086 wb_writeback+0x63f/0x900 fs/fs-writeback.c:2197 wb_check_old_data_flush fs/fs-writeback.c:2301 [inline] wb_do_writeback fs/fs-writeback.c:2354 [inline] wb_workfn+0x8cc/0xd60 fs/fs-writeback.c:2382 process_one_work+0x8e0/0x1980 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x683/0xf80 kernel/workqueue.c:3427 kthread+0x3f0/0x850 kernel/kthread.c:463 ret_from_fork+0x50f/0x610 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The faulting address sits 590 bytes inside a freed kmalloc-1k object allocated by ni_add_subrecord() and freed from ni_write_inode() writeback. [CAUSE] ntfs_readdir() loads all subrecords once, but then drops ni_lock() before it starts walking the directory metadata through ntfs_read_hdr(). That leaves the current NTFS_DE pointer backed by parent-directory subrecord memory that concurrent writeback is still allowed to compact and free. The later ntfs_dir_emit() -> ntfs_iget5() call exposes the stale e->ref, but the lifetime bug starts earlier: readdir is still consuming parent-directory metadata after releasing the lock that protects it. [FIX] Keep ni_lock() held from the point where ntfs_readdir() starts consuming the directory metadata until the walk over root/index entries is finished. This closes the parent-directory lifetime hole directly and keeps the existing readdir d_type behaviour unchanged. Signed-off-by: ZhengYuan Huang Signed-off-by: Konstantin Komarov

ntfs3: remove legacy ntfs driver support

2026-02-19T12:50:58+00:00

Reverts the following commits that introduced legacy ntfs driver alias and related support code: 74871791ffa9 ntfs3: serve as alias for the legacy ntfs driver 1ff2e956608c fs/ntfs3: Redesign legacy ntfs support 9b872cc50daa ntfs3: add legacy ntfs file operations d55f90e9b243 ntfs3: enforce read-only when used as legacy ntfs driver The legacy ntfs driver has been remade as a new implementation, so the alias and related codes in ntfs3 are no longer needed. Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon

Merge tag 'ntfs3_for_7.0' of https://github.com/Paragon-Software-Group/linux-ntfs3

2026-02-17T23:37:06+00:00

Pull ntfs3 updates from Konstantin Komarov: "New code: - improve readahead for bitmap initialization and large directory scans - fsync files by syncing parent inodes - drop of preallocated clusters for sparse and compressed files - zero-fill folios beyond i_valid in ntfs_read_folio() - implement llseek SEEK_DATA/SEEK_HOLE by scanning data runs - implement iomap-based file operations - allow explicit boolean acl/prealloc mount options - fall-through between switch labels - delayed-allocation (delalloc) support Fixes: - check return value of indx_find to avoid infinite loop - initialize new folios before use - infinite loop in attr_load_runs_range on inconsistent metadata - infinite loop triggered by zero-sized ATTR_LIST - ntfs_mount_options leak in ntfs_fill_super() - deadlock in ni_read_folio_cmpr - circular locking dependency in run_unpack_ex - prevent infinite loops caused by the next valid being the same - restore NULL folio initialization in ntfs_writepages() - slab-out-of-bounds read in DeleteIndexEntryRoot Updates: - allow readdir() to finish after directory mutations without rewinddir() - handle attr_set_size() errors when truncating files - make ntfs_writeback_ops static - refactor duplicate kmemdup pattern in do_action() - avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() Replaced: - use wait_on_buffer() directly - rename ni_readpage_cmpr into ni_read_folio_cmpr" * tag 'ntfs3_for_7.0' of https://github.com/Paragon-Software-Group/linux-ntfs3: (26 commits) fs/ntfs3: add delayed-allocation (delalloc) support fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() fs/ntfs3: add fall-through between switch labels fs/ntfs3: allow explicit boolean acl/prealloc mount options fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot ntfs3: Restore NULL folio initialization in ntfs_writepages() ntfs3: Refactor duplicate kmemdup pattern in do_action() fs/ntfs3: prevent infinite loops caused by the next valid being the same fs/ntfs3: make ntfs_writeback_ops static ntfs3: fix circular locking dependency in run_unpack_ex fs/ntfs3: implement iomap-based file operations fs/ntfs3: fix deadlock in ni_read_folio_cmpr fs/ntfs3: implement llseek SEEK_DATA/SEEK_HOLE by scanning data runs fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() fs/ntfs3: handle attr_set_size() errors when truncating files fs/ntfs3: drop preallocated clusters for sparse and compressed files fs/ntfs3: fsync files by syncing parent inodes fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super() fs/ntfs3: allow readdir() to finish after directory mutations without rewinddir() fs/ntfs3: improve readahead for bitmap initialization and large directory scans ...

Merge tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-02-10T00:58:28+00:00

Pull vfs 'struct filename' updates from Al Viro: "[Mostly] sanitize struct filename handling" * tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (68 commits) sysfs(2): fs_index() argument is _not_ a pathname alpha: switch osf_mount() to strndup_user() ksmbd: use CLASS(filename_kernel) mqueue: switch to CLASS(filename) user_statfs(): switch to CLASS(filename) statx: switch to CLASS(filename_maybe_null) quotactl_block(): switch to CLASS(filename) chroot(2): switch to CLASS(filename) move_mount(2): switch to CLASS(filename_maybe_null) namei.c: switch user pathname imports to CLASS(filename{,_flags}) namei.c: convert getname_kernel() callers to CLASS(filename_kernel) do_f{chmod,chown,access}at(): use CLASS(filename_uflags) do_readlinkat(): switch to CLASS(filename_flags) do_sys_truncate(): switch to CLASS(filename) do_utimes_path(): switch to CLASS(filename_uflags) chdir(2): unspaghettify a bit... do_fchownat(): unspaghettify a bit... fspick(2): use CLASS(filename_flags) name_to_handle_at(): use CLASS(filename_uflags) vfs_open_tree(): use CLASS(filename_uflags) ...

ntfs: ->d_compare() must not block

2026-01-13T20:16:44+00:00

... so don't use __getname() there. Switch it (and ntfs_d_hash(), while we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash() almost certainly can do with smaller allocations, but let ntfs folks deal with that - keep the allocation size as-is for now. Stop abusing names_cachep in ntfs, period - various uses of that thing in there have nothing to do with pathnames; just use k[mz]alloc() and be done with that. For now let's keep sizes as-in, but AFAICS none of the users actually want PATH_MAX. Signed-off-by: Al Viro

ntfs3: add setlease file operation

2026-01-12T09:55:47+00:00

Add the setlease file_operation to ntfs_file_operations, ntfs_legacy_file_operations, ntfs_dir_operations, and ntfs_legacy_dir_operations, pointing to generic_setlease. A future patch will change the default behavior to reject lease attempts with -EINVAL when there is no setlease file operation defined. Add generic_setlease to retain the ability to set leases on this filesystem. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260108-setlease-6-20-v1-14-ea4dec9b67fa@kernel.org Acked-by: Al Viro Acked-by: Christoph Hellwig Signed-off-by: Christian Brauner

fs/ntfs3: fsync files by syncing parent inodes

2025-12-29T13:33:19+00:00

Some xfstests expect fsync() on a file or directory to also persist directory metadata up the parent chain. Using generic_file_fsync() is not sufficient for ntfs, because parent directories are not explicitly written out. Signed-off-by: Konstantin Komarov

fs/ntfs3: allow readdir() to finish after directory mutations without rewinddir()

2025-12-19T18:04:01+00:00

This patch introduces a per-directory version counter that increments on each directory modification (indx_insert_entry() / indx_delete_entry()). ntfs_readdir() uses this version to detect whether the directory has changed since enumeration began. If readdir() reaches end-of-directory but the version has changed, the walk restarts from the beginning of the index tree instead of returning prematurely. This provides rmdir-like behavior for tools that remove entries as they enumerate them. Prior to this change, bonnie++ directory operations could fail due to premature termination of readdir() during concurrent index updates. With this patch applied, bonnie++ completes successfully with no errors. Signed-off-by: Konstantin Komarov

fs/ntfs3: improve readahead for bitmap initialization and large directory scans

2025-12-19T18:04:01+00:00

Previously sequential reads operations relied solely on single-page reads, causing the block layer to perform many synchronous I/O requests, especially for large volumes or large directories. This patch introduces explicit readahead via page_cache_sync_readahead() and file_ra_state to reduce I/O latency and improve sequential throughput. Signed-off-by: Konstantin Komarov