linux-toradex.git/fs/ntfs, branch master

ntfs: Use return instead of goto in ntfs_mapping_pairs_decompress()

2026-04-29T22:05:48+00:00

Clang warns (or errors with CONFIG_WERROR=y / W=e):

  fs/ntfs/runlist.c:755:6: error: variable 'rl' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
    755 |         if (overflows_type(lowest_vcn, vcn)) {
        |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ...
  fs/ntfs/runlist.c:971:9: note: uninitialized use occurs here
    971 |         kvfree(rl);
        |                ^~
  ...

rl has not been allocated at this point so the 'goto err_out' should
really just be a return of the error pointer -EIO.

Signed-off-by: Nathan Chancellor 
Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: drop nlink once for WIN32/DOS aliases

2026-04-29T22:05:46+00:00

NTFS could store a filename as paired WIN32 and DOS $FILE_NAME attributes
for directories. But ntfs_delete() deleted both attributes for unlinking
a directory, but it also called drop_nlink() for each attributes.
This could trigger warnings when unlinking directories.

Signed-off-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: fix invalid PTR_ERR() usage in __ntfs_bitmap_set_bits_in_run()

2026-04-28T12:59:59+00:00

The Smatch reported a warning in __ntfs_bitmap_set_bits_in_run():
"warn: passing a valid pointer to 'PTR_ERR'"

This occurs because the 'folio' variable might contain a valid pointer
when jumping to the 'rollback' label, specifically when 'cnt <= 0' is
detected during the subsequent page mapping loop. In such cases,
calling PTR_ERR(folio) is incorrect as it does not contain an error
code.

Fix this by introducing an explicit 'err' variable to track the error
status. This ensures that the rollback logic and the return value
consistently use a proper error code regardless of the state of the
folio pointer.

Reported-by: Dan Carpenter 
Signed-off-by: Namjae Jeon

ntfs: fix error handling in ntfs_write_iomap_end_resident()

2026-04-27T13:58:52+00:00

When ntfs_attr_get_search_ctx() fails and returns NULL, the function
returned early without calling put_page(ipage).
Fix this by jumping to err_out label on error. The err_out path now
properly releases the page and the mutex, with a NULL check for
the search context.

Reported-by: DaeMyung Kang 
Signed-off-by: Namjae Jeon

ntfs: fix VCN overflow in ntfs_mapping_pairs_decompress()

2026-04-27T13:31:19+00:00

In ntfs_mapping_pairs_decompress(), lowest_vcn is read from
on-disk metadata and used as the initial vcn without validation.
A malformed value can introduce an invalid (e.g. negative) vcn,
corrupting the runlist from the start.

Additionally, the accumulation
    vcn += deltaxcn

does not check for s64 overflow. A crafted mapping pairs array
can wrap vcn to a negative value, breaking the monotonically-
increasing invariant relied upon by ntfs_rl_vcn_to_lcn() and
related helpers.

Fix this by validating lowest_vcn and using check_add_overflow()
for vcn accumulation.

Signed-off-by: Zhan Xusheng 
Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: fix WSL symlink target leak on reparse failure

2026-04-27T13:29:08+00:00

ntfs_reparse_set_wsl_symlink() converts the symlink target into an
allocated NLS string and transfers ownership to ni->target only after
ntfs_set_ntfs_reparse_data() succeeds. If setting the reparse data fails,
the converted target is left unreferenced and leaks.

Free the converted target on the reparse update failure path. Use kfree()
for the other local failure path as well, matching the ntfs_ucstonls()
allocation contract.

Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
Signed-off-by: DaeMyung Kang 
Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: fix NULL dereference in ntfs_index_walk_down()

2026-04-27T13:29:04+00:00

ntfs_index_walk_down() allocates ictx->ib when descending from the root
into an index allocation block. If that allocation fails, the old code
still passes the NULL buffer to ntfs_ib_read(), which can write through
it via ntfs_inode_attr_pread().

Allocate the index block into a temporary pointer and return -ENOMEM
before changing the index context on allocation failure. Also propagate
ERR_PTR() through ntfs_index_next() and ntfs_readdir() so walk-down
allocation or index block read failures are not mistaken for normal
index iteration inside the filesystem.

ntfs_readdir() keeps the existing userspace-visible behavior of
suppressing readdir errors after marking end_in_iterate; this change only
prevents the walk-down failure path from dereferencing NULL internally.

The failure was reproduced with failslab fail-nth injection on getdents64;
the original module hits a NULL pointer dereference in memcpy_orig through
ntfs_ib_read(), while the patched module reaches the same
ntfs_index_walk_down() allocation failure without crashing.

Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations")
Signed-off-by: DaeMyung Kang 
Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: use page allocation for resident attribute inline data

2026-04-22T10:05:07+00:00

The current kmemdup() based allocation for IOMAP_INLINE can result in
inline_data pointer having a non-zero page offset. This causes
iomap_inline_data_valid() to fail the check:

    iomap->length <= PAGE_SIZE - offset_in_page(iomap->inline_data)

and triggers the kernel BUG at fs/iomap/buffered-io.c:1061.

This particularly affects workloads with frequent small file access
(e.g. Firefox Nightly profile on NTFS with bind mount) when using the
new ntfs. This fix this by allocating a full page with alloc_page() so that
page_address() always returns a page-aligned address.

Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: fix mmap_prepare writable check for shared mappings

2026-04-22T09:33:15+00:00

Linus pointed out that checking only VMA_WRITE_BIT is incorrect.
Private writable mappings (MAP_PRIVATE) set VM_WRITE but do not
write back to the filesystem. Also, mappings that can become
writable via mprotect() (VM_MAYWRITE) must be handled.

Use vma_desc_test_all(VMA_SHARED_BIT, VMA_MAYWRITE_BIT) instead,
which matches what other filesystems do.

Suggested-by: Linus Torvalds 
Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: fix potential 32-bit truncation in ntfs_write_cb()

2026-04-18T02:33:21+00:00

Smatch warned that the bitwise negation in ntfs_write_cb() might lead to
unintended truncation. Casting the block size to loff_t before bitwise
negation prevents the upper 32 bits of pos from being incorrectly zeroed
out during the calculation of new_vcn.

Signed-off-by: Dan Carpenter 
Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon