linux-stable.git/fs/ntfs/inode.c, branch linux-rolling-stable

ntfs: make system files immutable to prevent corruption

2026-07-24T14:21:01+00:00

commit f72df3a4c33b64de3418ec74d1ad4f028e09d161 upstream.

When a system file such as $Bitmap is exposed via show_sys_files and
written from userspace, the volume is corrupted and, because the cluster
allocator scans $Bitmap through the same inode's page cache, a write to
$Bitmap also deadlocks writeback against the folio it already holds locked.

These files are maintained by the driver itself and have no valid reason
to be written through the file interface. Mark base metadata files
(mft_no < FILE_first_user) as immutable during inode read so the VFS
rejects write, mmap, truncate and unlink with -EPERM. Directories are
skipped so the root and $Extend remain usable. Internal metadata updates
do not go through the VFS write path and are unaffected.

Fixes: af0db57d4293 ("ntfs: update inode operations")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon 
Signed-off-by: Greg Kroah-Hartman

ntfs: validate index entries on reading

2026-07-24T14:20:59+00:00

commit 2221b691d7b2e17f08153f95848dacaa5d87e21d upstream.

Validate index entries immediately after reading an index root or index
block from disk. This eliminates repeated checks in lookup and readdir,
and reduce the risk of missing checks in those paths.

Cc: stable@vger.kernel.org # v7.1
Tested-by: woot000 
Signed-off-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon 
Signed-off-by: Greg Kroah-Hartman

ntfs: centalize $INDEX_ROOT header validation

2026-07-24T14:20:59+00:00

commit 8b97b302f553a480fb76d2afd53cd6c0635a9dcd upstream.

Add a dedicated helper to perform stricter validation of $INDEX_ROOT and
use it for both directory inodes and named index inodes. This keeps the
root size and header geometry checks consistent across both read paths.

Cc: stable@vger.kernel.org # v7.1
Tested-by: woot000 
Signed-off-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon 
Signed-off-by: Greg Kroah-Hartman

ntfs: fix incorrect size of symbolic link

2026-07-24T14:20:58+00:00

commit 05a5ff86a7f12c861e3516d3dc4d092ce620742d upstream.

This patch fixes the issue where a symbolic link size is displayed as 0.

Cc: stable@vger.kernel.org # v7.1
Signed-off-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon 
Signed-off-by: Greg Kroah-Hartman

ntfs: bound the attribute-list entry in ntfs_read_inode_mount()

2026-07-24T14:19:37+00:00

[ Upstream commit 98634df5b1cb56c26299b7409227025ddb0167d8 ]

The $MFT attribute-list walk in ntfs_read_inode_mount() validates each
entry only with "(u8 *)al_entry + 6 > al_end" and
"(u8 *)al_entry + le16_to_cpu(al_entry->length) > al_end", but then reads
al_entry->lowest_vcn (an __le64 at offset 8) and al_entry->mft_reference
(offset 16) -- fields beyond the 6 bytes proven in range. al_entry->length
is attacker-controlled and only required non-zero, so a short entry (e.g.
length 8) placed at the tail passes both checks while the lowest_vcn /
mft_reference reads fall past al_end.

al_end is ni->attr_list + attr_list_size (the on-disk size); the buffer is
kvzalloc(round_up(attr_list_size, SECTOR_SIZE)), so the sector rounding
usually absorbs the over-read -- but when attr_list_size is a multiple of
SECTOR_SIZE there is no slack and a crafted $MFT attribute list produces an
out-of-bounds read at mount time.

Validate the entry with ntfs_attr_list_entry_is_valid() (added in patch
1/3) before dereferencing it, matching the bound the other attribute-list
walks now use. The validator already requires the length to cover the fixed
header, which makes the separate "!al_entry->length" check redundant, so
drop it too.

Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
Signed-off-by: Bryam Vargas 
Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon 
Signed-off-by: Sasha Levin

ntfs: validate resident attribute lists and harden the validator

2026-07-24T14:19:37+00:00

[ Upstream commit 7d19e1ffee084c4f7d321a360c14ba43404f7cc8 ]

A base inode's $ATTRIBUTE_LIST is sanity-checked by load_attribute_list()
only on the non-resident path; ntfs_read_locked_inode() copies a *resident*
attribute list into ni->attr_list with a plain memcpy() and no validation
at all. Every subsequent walk of ni->attr_list --
ntfs_external_attr_find(), ntfs_inode_attach_all_extents() and
ntfs_attrlist_need() -- then trusts the entries are well-formed and reads
attr_list_entry fixed-header fields
(lowest_vcn at offset 8, mft_reference at offset 16, and the name) with
bounds that assume validation already happened. A crafted resident
attribute list therefore reaches those walks unvalidated and can drive
out-of-bounds reads of the attribute-list buffer.

load_attribute_list() itself reads ale->name_offset (offset 7),
ale->mft_reference (offset 16) and the name length under only an
"al < al_start + size" bound, so its own validation loop can over-read the
fixed header of a truncated trailing entry by a few bytes.

Factor the per-entry validation into ntfs_attr_list_entry_is_valid(),
which requires each entry's fixed header (offsetof(struct
attr_list_entry, name)) to be in range before any field is dereferenced,
that ale->length is a multiple of 8 covering the fixed header plus the
name, and that the entry is in use and carries a live MFT reference.
ntfs_attr_list_is_valid() walks the buffer with it and checks the entries
tile it exactly. Use the list validator in load_attribute_list()
(replacing the open-coded loop, closing its own over-read) and on the
resident path in ntfs_read_locked_inode() (which previously skipped
validation entirely); patches 2/3 reuse the per-entry helper at the other
two attribute-list walks.

Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
Signed-off-by: Bryam Vargas 
Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon 
Signed-off-by: Sasha Levin

ntfs: avoid use-after-free of index inode in ntfs_inode_sync_filename()

2026-05-08T14:50:57+00:00

ntfs_inode_sync_filename() walks every FILE_NAME attribute and, for
each one that points at a different parent, opens the parent index
inode with ntfs_iget() and locks index_ni->mrec_lock.  All three error
branches (NInoBeingDeleted, ntfs_index_ctx_get failure, ntfs_index_lookup
failure) drop the parent reference before unlocking:

	iput(index_vi);
	mutex_unlock(&index_ni->mrec_lock);
	continue;

index_ni is NTFS_I(index_vi), so the ntfs_inode (and its mrec_lock) is
embedded in the inode allocation.  If the parent directory is not held
outside the icache - no open dentry, recently evicted from dcache, no
other concurrent lookup - ntfs_iget() returns with i_count == 1 and
our iput() drops the last reference.  evict_inode() then runs and
destroy_inode() schedules the slab object for RCU free, while
mutex_unlock() on the next line is still touching index_ni->mrec_lock.

Swap the order so the mutex is dropped while index_vi is still alive,
matching the success path at the bottom of the loop which already
unlocks before iput().

Reproduced under KASAN with a debug build that forces
ntfs_index_ctx_get() to fail when the parent index inode has been
opened with i_count == 1.  KASAN reports a slab-use-after-free read
on the parent's mrec_lock from mutex_unlock() on the writeback worker:

  BUG: KASAN: slab-use-after-free in __mutex_unlock_slowpath+0xb5/0x970
  Read of size 8 at addr ffff8880014b7598 by task kworker/u8:0/12
  Workqueue: writeback wb_workfn (flush-253:0)
  Call Trace:
   mutex_unlock
   ntfs_inode_sync_filename
   __ntfs_write_inode
   ntfs_write_inode
   __writeback_single_inode

  Allocated by task 103:
   ntfs_alloc_big_inode
   ntfs_iget
   ntfs_lookup
   __x64_sys_mkdir

  Freed by task 12:
   ntfs_free_big_inode
   i_callback
   rcu_do_batch

  Last potentially related work creation:
   call_rcu
   destroy_inode
   evict
   dispose_list
   evict_inodes
   ntfs_inode_sync_filename
   __ntfs_write_inode

  The buggy address belongs to the object at ffff8880014b7440
   which belongs to the cache ntfs_big_inode_cache of size 1800

The freed object is the parent directory inode itself: allocated by
mkdir(2) via ntfs_iget(), then released through call_rcu(i_callback)
that destroy_inode() scheduled when evict_inodes() ran from inside
ntfs_inode_sync_filename().  Re-running the same workload with
mutex_unlock() moved before iput() runs cleanly under KASAN.

Fixes: af0db57d4293 ("ntfs: update inode operations")
Signed-off-by: DaeMyung Kang 
Reviewed-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: remove redundant out-of-bound checks

2026-04-07T09:36:13+00:00

Remove redundant out-of-bounds validations.
Since ntfs_attr_find and ntfs_external_attr_find
now validate the attribute value offsets and
lengths against the bounds of the MFT record block,
performing subsequent bounds checking in caller
functions like ntfs_attr_lookup is no longer necessary.

Signed-off-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: fix ignoring unreachable code warnings

2026-03-16T11:27:52+00:00

Detected by Smatch.

inode.c:1796 load_attribute_list_mount() warn:
  ignoring unreachable code.

Signed-off-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon

ntfs: fix variable dereferenced before check warnings

2026-03-16T11:27:45+00:00

Detected by Smatch.

lcnalloc.c:736 ntfs_cluster_alloc() error:
  we previously assumed 'rl' could be null (see line 719)

inode.c:3275 ntfs_inode_close() warn:
  variable dereferenced before check 'tmp_nis' (see line 3255)

attrib.c:4952 ntfs_attr_remove() warn:
  variable dereferenced before check 'ni' (see line 4951)

dir.c:1035 ntfs_readdir() error:
  we previously assumed 'private' could be null (see line 850)

Signed-off-by: Hyunchul Lee 
Signed-off-by: Namjae Jeon