linux-stable.git/fs/ntfs/logfile.c, branch linux-rolling-stable

ntfs: fix u16 truncation of restart-area length check

2026-07-24T14:19:37+00:00

[ Upstream commit 390936fb15053d8d8991ca3a22776e251a5a7f2f ]

ntfs_check_restart_area() validates that the $LogFile restart area and
its trailing log client record array fit within the system page size:

        u16 ra_ofs, ra_len, ca_ofs;
        ...
        ra_len = ca_ofs + le16_to_cpu(ra->log_clients) *
                        sizeof(struct log_client_record);
        if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...)
                return false;

ra_len is u16, but the right-hand side is computed in size_t
(sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients
come straight from the on-disk restart area. With an on-disk
log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and
storing into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64
gives ra_len 128), so the "fits in the page" check passes even though
the client array described by log_clients extends far beyond the page.

ntfs_check_log_client_array() then walks the array bounded only by the
on-disk log_clients count:

        cr = ca + idx;
        if (cr->prev_client != LOGFILE_NO_CLIENT) ...

For log_clients 410 it dereferences records up to ca + 409 * 160,
~64 KiB past the kvzalloc(system_page_size) restart-page buffer -- an
out-of-bounds read of attacker-controlled extent, reachable when a
crafted NTFS image is mounted (load_and_check_logfile() at mount time).
This is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g
userspace driver but never in this revived classic driver.

Compute the restart-area length in a u32 so the existing bounds check
rejects an over-large client array instead of being defeated by the
truncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded
from __le16 on-disk fields and every comparison already promotes to
int/size_t, so this changes no result and keeps the declaration uniform.

Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
Signed-off-by: Bryam Vargas 
Signed-off-by: Namjae Jeon 
Signed-off-by: Sasha Levin

ntfs: fix empty_buf and ra lifetime bugs in ntfs_empty_logfile()

2026-05-10T07:45:28+00:00

ntfs_empty_logfile() has three related allocator bugs around the
@empty_buf and @ra buffers it uses inside the per-cluster loop.

When the loop encounters a runlist entry with LCN_RL_NOT_MAPPED, the
function kvfrees @empty_buf and goes to map_vcn to remap.  @empty_buf
is not cleared.  If ntfs_map_runlist_nolock() fails on re-entry,
control jumps to the err label which kvfrees @empty_buf a second time.

In the same branch, @ra is left allocated.  When the remap succeeds
the function falls through the @empty_buf re-allocation and the @ra
re-allocation, overwriting the previous @ra pointer and leaking it.

The success path frees @empty_buf with kfree() instead of kvfree().
kvzalloc() may fall back to vmalloc(), in which case kfree() does not
correctly release the memory.

A KASAN-enabled QEMU harness mirroring this control flow reports
"BUG: KASAN: double-free" when the second ntfs_map_runlist_nolock()
fails.

Clear both @empty_buf and @ra after the in-loop releases so the err
path is a no-op when the buffers have already been freed and so the
remap-success path does not leak the previous @ra.  Switch the success
path to kvfree() to match the @empty_buf allocator.

Fixes: 5218cd102aec ("ntfs: update misc operations")
Signed-off-by: DaeMyung Kang 
Signed-off-by: Namjae Jeon

ntfs: update misc operations

2026-02-19T12:50:56+00:00

Updates various miscellaneous operations including collation,
debugging, logfile handling, unicode string processing, bdev io helpers,
object id system file handling.

Acked-by: Christoph Hellwig 
Signed-off-by: Namjae Jeon

Revert "fs: Remove NTFS classic"

2026-02-19T12:48:05+00:00

This reverts commit 7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89.

Reverts the removal of the classic read-only ntfs driver to
serve as the base for a new read-write ntfs implementation.
If we stack changes on top of the revert patch, It will significantly
reduce the diff size, making the review easier.

This revert intentionally excludes the restoration of Kconfig and
Makefile. The Kconfig and Makefile will be added back in the final patch
of this series, enabling the driver only after all features and
improvements have been applied.

Acked-by: Christoph Hellwig 
Signed-off-by: Namjae Jeon

fs: Remove NTFS classic

2024-01-24T09:47:00+00:00

The replacement, NTFS3, was merged over two years ago.  It is now time to
remove the original from the tree as it is the last user of several APIs,
and it is not worth changing.

Signed-off-by: Matthew Wilcox (Oracle) 
Link: https://lore.kernel.org/r/20240115072025.2071931-1-willy@infradead.org
Acked-by: Namjae Jeon 
Acked-by: Dave Chinner 
Cc: Anton Altaparmakov 
Cc: Namjae Jeon 
Signed-off-by: Christian Brauner

fs/buffer: Combine two submit_bh() and ll_rw_block() arguments

2022-07-14T18:14:32+00:00

Both submit_bh() and ll_rw_block() accept a request operation type and
request flags as their first two arguments. Micro-optimize these two
functions by combining these first two arguments into a single argument.
This patch does not change the behavior of any of the modified code.

Cc: Alexander Viro 
Cc: Jan Kara 
Acked-by: Song Liu  (for the md changes)
Signed-off-by: Bart Van Assche 
Link: https://lore.kernel.org/r/20220714180729.1065367-48-bvanassche@acm.org
Signed-off-by: Jens Axboe

fs/ntfs: remove unused varibles

2020-12-15T20:13:37+00:00

We actually don't use these varibles, so remove them to avoid gcc warning:

  fs/ntfs/file.c:326:14: warning: variable `base_ni' set but not used [-Wunused-but-set-variable]
  fs/ntfs/logfile.c:481:21: warning: variable `log_page_mask' set but not used [-Wunused-but-set-variable]

Link: https://lkml.kernel.org/r/1604821092-54631-1-git-send-email-alex.shi@linux.alibaba.com
Signed-off-by: Alex Shi 
Acked-by: Anton Altaparmakov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96

2019-05-24T15:37:53+00:00

Based on 1 normalized pattern(s):

  this program include file is free software you can redistribute it
  and or modify it under the terms of the gnu general public license
  as published by the free software foundation either version 2 of the
  license or at your option any later version this program include
  file is distributed in the hope that it will be useful but without
  any warranty without even the implied warranty of merchantability or
  fitness for a particular purpose see the gnu general public license
  for more details you should have received a copy of the gnu general
  public license along with this program in the main directory of the
  linux [ntfs] distribution in the file copying if not write to the
  free software foundation inc 59 temple place suite 330 boston ma
  02111 1307 usa

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 43 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Richard Fontana 
Reviewed-by: Allison Randal 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190520075212.517001706@linutronix.de
Signed-off-by: Greg Kroah-Hartman

block,fs: untangle fs.h and blk_types.h

2016-11-01T15:43:26+00:00

Nothing in fs.h should require blk_types.h to be included.

Signed-off-by: Christoph Hellwig 
Signed-off-by: Jens Axboe

fs: have submit_bh users pass in op and flags separately

2016-06-07T19:41:38+00:00

This has submit_bh users pass in the operation and flags separately,
so submit_bh_wbc can setup the bio op and bi_rw flags on the bio that
is submitted.

Signed-off-by: Mike Christie 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Jens Axboe