[PATCH] ntfs3: reject empty iomap before reading its LCN

[PATCH] ntfs3: reject empty iomap before reading its LCN

[Yousef Alhouseen]

attr_data_get_block() can return success with a zero run length when no
cached or on-disk mapping covers a read VCN. In that case it does not
initialize the LCN output.

Check the returned length before comparing the LCN against the special
mapping values. This preserves the existing -EINVAL result for an empty
mapping without passing an uninitialized LCN to the comparisons.

Fixes: ecbb433f9a8e ("fs/ntfs3: fold file size handling into ntfs_set_size()")
Reported-by: syzbot+4b4ec878e25fafefa70f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b4ec878e25fafefa70f
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
 fs/ntfs3/inode.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index c43101cc064d..a428f03a695d 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -777,6 +777,8 @@ static int ntfs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
 	if (err) {
 		return err;
 	}
+	if (!clen)
+		return -EINVAL;
 
 	if (lcn == EOF_LCN) {
 		/* request out of file. */
@@ -811,11 +813,6 @@ static int ntfs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
 		return 0;
 	}
 
-	if (!clen) {
-		/* broken file? */
-		return -EINVAL;
-	}
-
 	iomap->bdev = inode->i_sb->s_bdev;
 	iomap->offset = offset;
 	iomap->length = ((loff_t)clen << cluster_bits) - off;
-- 
2.55.0

Re: [PATCH] ntfs3: reject empty iomap before reading its LCN

[Konstantin Komarov]

On 6/30/26 23:17, Yousef Alhouseen wrote:

> attr_data_get_block() can return success with a zero run length when no
> cached or on-disk mapping covers a read VCN. In that case it does not
> initialize the LCN output.
>
> Check the returned length before comparing the LCN against the special
> mapping values. This preserves the existing -EINVAL result for an empty
> mapping without passing an uninitialized LCN to the comparisons.
>
> Fixes: ecbb433f9a8e ("fs/ntfs3: fold file size handling into ntfs_set_size()")
> Reported-by: syzbot+4b4ec878e25fafefa70f@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=4b4ec878e25fafefa70f
> Cc: stable@vger.kernel.org
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
> ---
>   fs/ntfs3/inode.c | 7 ++-----
>   1 file changed, 2 insertions(+), 5 deletions(-)
>
> diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
> index c43101cc064d..a428f03a695d 100644
> --- a/fs/ntfs3/inode.c
> +++ b/fs/ntfs3/inode.c
> @@ -777,6 +777,8 @@ static int ntfs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
>          if (err) {
>                  return err;
>          }
> +       if (!clen)
> +               return -EINVAL;
>
>          if (lcn == EOF_LCN) {
>                  /* request out of file. */
> @@ -811,11 +813,6 @@ static int ntfs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
>                  return 0;
>          }
>
> -       if (!clen) {
> -               /* broken file? */
> -               return -EINVAL;
> -       }
> -
>          iomap->bdev = inode->i_sb->s_bdev;
>          iomap->offset = offset;
>          iomap->length = ((loff_t)clen << cluster_bits) - off;
> --
> 2.55.0

Hello,

Sorry for the delay.
Your patch is applied, thank you.

Regards,
Konstantin