summaryrefslogtreecommitdiff
path: root/fs/ntfs/ea.c
AgeCommit message (Collapse)AuthorFilesLines
8 daystreewide: refresh kmalloc_obj() conversionsKees Cook1-1/+1
This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org>
2026-08-27ntfs: leave HasEA flag untouched on setxattr failureBaolin Liu1-4/+6
In ntfs_set_ea(), the exit path unconditionally updates the HasEA flag based on ea_info_qsize. When an error occurs before ea_info_qsize is updated, NInoClearHasEA() hides existing on-disk EAs until the inode is evicted. Only update the flag on success. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Signed-off-by: Baolin Liu <liubaolin@kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-27ntfs: fix memmove overlap in ntfs_new_attr_flagsHongling Zeng1-6/+27
When the record shrinks while the payload offsets increase (e.g., enabling compression reduces padding, making arec_size < old_arec_size, but the header grows by 8 bytes), moving the name first can overwrite the old mapping_pairs before they are copied. Move mapping_pairs first in this case. Since mp_ofs is derived from name_ofs, they always change in the same direction. Checking name_ofs alone is sufficient. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Cc: stable@vger.kernel.org Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-26ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resizeHongling Zeng1-1/+1
ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent record, ctx->mrec points to the extent but the function receives the base record pointer m, causing incorrect size calculations in memmove. Fix by passing ctx->mrec (the actual MFT record containing the attribute) instead of m (the base MFT record) to ntfs_attr_record_resize(). Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Cc: stable@vger.kernel.org Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-26ntfs: return -ERANGE for undersized xattr bufferBaolin Liu1-2/+2
When the value buffer passed to getxattr(2) for system.dos_attrib, system.ntfs_attrib or system.ntfs_attrib_be is smaller than the attribute value, ntfs_getxattr() returns -ENODATA, which tells userspace the attribute does not exist. The xattr API expects -ERANGE in this case, and ntfs_get_ea() in the same file already returns -ERANGE for regular EAs. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Signed-off-by: Baolin Liu <liubaolin@kylinos.cn> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-21ntfs: add non-resident WOF decompressionHyunchul Lee1-1/+21
Introduce non-resident Windows System Compression (WOF) decompression support. Add wof.c containing parse_wof_chunk_table() and ntfs_read_wof_compressed_block(), and routing them via transparent codec ops table with dynamic scratch memory allocation. Hook up ntfs_readpage/read_folio paths in aops.c to delegate to the WOF block reader when NInoWofCompressed is set. Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-21ntfs: return errors from ntfs_attr_readallHyunchul Lee1-7/+31
ntfs_attr_readall() currently loses the failure reason for attribute lookup, allocation, and read failures by returning NULL. Return ERR_PTR() with the original error instead. The reparse parser can then propagate allocation and I/O errors without treating them as filesystem corruption. Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-20ntfs: fix resource leak in ntfs_new_attr_flagsHongling Zeng1-2/+4
When handling resident attributes that don't need sparse/compressed changes, ntfs_new_attr_flags() returns 0 directly at line 678 without calling unmap_mft_record() or ntfs_attr_put_search_ctx(). This leaks the MFT record mapping and attribute search context. An unprivileged user can cause a denial of service by repeatedly calling setxattr(2) with system.ntfs_attrib on files with resident attributes, eventually exhausting kernel memory. Fix by replacing the direct return with goto err_out to ensure proper cleanup of resources via the existing cleanup code. Fixes: e791930240a5 ("ntfs: fix resident conversion in ntfs_new_attr_flags") Cc: stable@vger.kernel.org Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-19ntfs: do not update ctime when setxattr failsBaolin Liu1-2/+4
ntfs_setxattr() updates ctime and marks the inode dirty even when the operation fails. A failed setxattr(2) must not change file metadata. Update ctime only on success. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Signed-off-by: Baolin Liu <liubaolin@kylinos.cn> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-19ntfs: reject unprivileged writes to reserved $LX* xattrsPisit Preechapramoth1-0/+9
Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAP_SYS_ADMIN. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Signed-off-by: Pisit Preechapramoth <kml.delusion501@slmail.me> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-19ntfs: respect per-file chmod mode over mount masksNamjae Jeon1-11/+9
fmask and dmask provide the default permissions for files without WSL metadata. Once chmod stores a mode in $LXMOD, however, that per-file mode must take precedence so selected files can retain permissions such as execute across remounts. Record whether $LXMOD was found while loading an inode and apply the mount masks only when it is absent. Do not remask the in-memory mode after setattr persists it. Continue loading $LXMOD even when optional $LXUID or $LXGID metadata is missing, since chmod may create only $LXMOD. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-19ntfs: move attribute payload before shrinking its recordNamjae Jeon1-8/+15
ntfs_new_attr_flags() resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is cleared. Shrinking the record first moves the following attribute over the tail of the old record. The subsequent memmove() therefore copies bytes from that following attribute instead of the old mapping pairs. Re-enabling compression on an empty file persists those bytes as a malformed mapping pairs array, which ntfsck reports as a missing or invalid run length. Move the payload before shrinking the record, while retaining the existing resize-before-move ordering when growing it. Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-19ntfs: fix resident conversion in ntfs_new_attr_flagsHyunchul Lee1-22/+72
When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated. Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-19ntfs: rewrite EA stream before updating metadataNamjae Jeon1-19/+46
Updating an EA removes the old record and appends its replacement. Build the complete $EA stream in memory and rewrite it from offset zero, rather than committing a compacted stream followed by a separate append. generic/642 shows that the append path can leave an invalid record layout on disk, including when a new EA entry is added. When removing an EA, write the compacted stream before updating $EA_INFORMATION and restore the original pair if the metadata update fails. When the final EA entry is removed the $EA/$EA_INFORMATION pair is torn down. If removing $EA_INFORMATION fails after $EA has already been removed, the original $EA is restored so the two attributes stay consistent. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-19ntfs: remove empty EA attribute pairNamjae Jeon1-0/+9
Removing the final xattr leaves an empty $EA stream. An empty $EA attribute paired with $EA_INFORMATION is not a valid EA chain and ntfsck reports it as corrupt. Remove both attributes when the final EA entry is deleted. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-19ntfs: validate final EA attribute sizeNamjae Jeon1-2/+15
A replacement first removes the existing EA record, then adds the replacement. Check the size of that final $EA stream before mutating the current stream. This avoids committing the shortened $EA stream or $EA_INFORMATION before discovering that the replacement exceeds the AttrDef size limit. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-06-06ntfs: add bounds check before accessing EA entriesHyunchul Lee1-8/+8
in ntfs_ea_lookup and ntfs_listxattr, this verifies that there is enough space in the EA entry before accessing the next_entry_offset field of the EA entry. Cc: stable@vger.kernel.org # v7.1 Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-04-18ntfs: fix uninitialized variables in ntfs_ea_set_wsl_inode()Namjae Jeon1-1/+4
Smatch reported uninitialized symbol warnings in ntfs_ea_set_wsl_inode() and __ntfs_create(). In ntfs_ea_set_wsl_inode(), the err variable could be returned without initialization if no flags are set and rdev is zero. Additionally, ea_size might remain uninitialized from the caller's perspective if no EA operations are performed. While these cases might not be triggered under current logic, we initialize them to zero to satisfy the static checker. Reported-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-03-16ntfs: harden ntfs_listxattr against EA entriesHyunchul Lee1-18/+22
Validate every EA entry only if the buffer length is required to prevent large memory allocation. Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-03-16ntfs: harden ntfs_ea_lookup against malformed EA entriesHyunchul Lee1-19/+17
Validate p_ea->ea_name_length tightly, and the used entry size for every EA. Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-03-16ntfs: check $EA query-length in ntfs_ea_getHyunchul Lee1-0/+5
if ea_info_qlen exceeds all_ea_size, OOB can happen. Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-03-16ntfs: validate WSL EA payload sizesHyunchul Lee1-2/+6
Enforce the exact-size reads for $LXUID, $LXGID, $LXMOD, $LXDEV. Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-03-16ntfs: fix WSL ea restore conditionHyunchul Lee1-1/+1
Use NTFS_VOL_GID(not NTFS_VOL_UID) for restoring the gid, and call ntfs_ea_get_wsl_inode() only when $EA_INFORMATION exists. Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-03-10ntfs: add missing newlines to pr_err() messagesWoody Suwalski1-1/+1
There is an inconsistent use of pr_err() statements in the current code. Many error messages are missing the \n termination, what results in the messages being printed with a delay, only after a next printk() line is printed. It prevents relying on printk() to monitor the driver errors. This patch is modifying only text messages, no functional change. Signed-off-by: Woody Suwalski <terraluna977@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-02-26ntfs: Fix null pointer dereferenceEthan Tidmore1-1/+2
The variable ctx can be null and once confirmed to be null in its error path goes to label err_out. Once there it can be immediately dereferenced by the function ntfs_attr_put_search_ctx() which has no null pointer check. Detected by Smatch: fs/ntfs/ea.c:687 ntfs_new_attr_flags() error: we previously assumed 'ctx' could be null (see line 577) Add null pointer check before running ntfs_attr_put_search_ctx() in error path. Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-02-19ntfs: add reparse and ea operationsNamjae Jeon1-0/+942
Implement support for Extended Attributes and Reparse Points, enabling Posix ACL support and, and compatibility with Windows Subsystem for Linux (WSL) metadata. Acked-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
generated by cgit (git 2.54.0.dirty) at 2026-09-13 11:22:02 +0000