[PATCH] ntfs: don't allow compression on volumes with clusters larger than 4K

[PATCH] ntfs: don't allow compression on volumes with clusters larger than 4K

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

On a volume made with "mkntfs -c 8192", a user can set
FILE_ATTR_COMPRESSED on an empty file through system.ntfs_attrib.
Writing to the file and reading it back after dropping the page cache
then crashes:

  BUG: KASAN: slab-out-of-bounds in ntfs_read_compressed_block+0xa2c/0x2040
  Read of size 8192 at addr ffff88804355a000 by task dd/106

The read path only handles clusters up to 4K. It copies each cluster
out of a single page, and a compression block of 16 8K clusters does
not fit in the 64K ntfs_compression_buffer. Loading an inode already
rejects compressed data on such volumes.

Reject the flag change the same way.

Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
Cc: stable@vger.kernel.org
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
 fs/ntfs/ea.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index fa5c5c625751..68397b2a4e43 100644
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -721,6 +721,11 @@ static int ntfs_new_attr_flags(struct ntfs_inode *ni, __le32 fattr)
 		goto err_out;
 	}
 
+	if ((new_aflags & ATTR_IS_COMPRESSED) && ni->vol->cluster_size > 4096) {
+		err = -EOPNOTSUPP;
+		goto err_out;
+	}
+
 	if (!a->non_resident) {
 		if (!(new_aflags & (ATTR_IS_SPARSE | ATTR_IS_COMPRESSED))) {
 			err = 0;
-- 
2.43.0

Re: [PATCH] ntfs: don't allow compression on volumes with clusters larger than 4K

[liubaolin]

在 2026/11/2 17:35, Zhan Xusheng 写道:
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> 
> On a volume made with "mkntfs -c 8192", a user can set
> FILE_ATTR_COMPRESSED on an empty file through system.ntfs_attrib.
> Writing to the file and reading it back after dropping the page cache
> then crashes:
> 
>    BUG: KASAN: slab-out-of-bounds in ntfs_read_compressed_block+0xa2c/0x2040
>    Read of size 8192 at addr ffff88804355a000 by task dd/106
> 
> The read path only handles clusters up to 4K. It copies each cluster
> out of a single page, and a compression block of 16 8K clusters does
> not fit in the 64K ntfs_compression_buffer. Loading an inode already
> rejects compressed data on such volumes.
> 
> Reject the flag change the same way.
> 
> Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> ---
>   fs/ntfs/ea.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
> index fa5c5c625751..68397b2a4e43 100644
> --- a/fs/ntfs/ea.c
> +++ b/fs/ntfs/ea.c
> @@ -721,6 +721,11 @@ static int ntfs_new_attr_flags(struct ntfs_inode *ni, __le32 fattr)
>   		goto err_out;
>   	}
>   
> +	if ((new_aflags & ATTR_IS_COMPRESSED) && ni->vol->cluster_size > 4096) {
> +		err = -EOPNOTSUPP;
> +		goto err_out;
> +	}
> +
>   	if (!a->non_resident) {
>   		if (!(new_aflags & (ATTR_IS_SPARSE | ATTR_IS_COMPRESSED))) {
>   			err = 0;


Looks good to me.

Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>

Re: [PATCH] ntfs: don't allow compression on volumes with clusters larger than 4K

[Namjae Jeon]

On Mon, Nov 2, 2026 at 6:35 PM Zhan Xusheng <zhanxusheng1024@gmail.com> wrote:
>
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
>
> On a volume made with "mkntfs -c 8192", a user can set
> FILE_ATTR_COMPRESSED on an empty file through system.ntfs_attrib.
> Writing to the file and reading it back after dropping the page cache
> then crashes:
>
>   BUG: KASAN: slab-out-of-bounds in ntfs_read_compressed_block+0xa2c/0x2040
>   Read of size 8192 at addr ffff88804355a000 by task dd/106
>
> The read path only handles clusters up to 4K. It copies each cluster
> out of a single page, and a compression block of 16 8K clusters does
> not fit in the 64K ntfs_compression_buffer. Loading an inode already
> rejects compressed data on such volumes.
>
> Reject the flag change the same way.
>
> Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Applied it to #ntfs-next.
Thanks!