[PATCH 0/5] ntfs: fix incorrect error codes returned to callers

[PATCH 0/5] ntfs: fix incorrect error codes returned to callers

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

Five places in fs/ntfs/ return the wrong error code: a real errno is
replaced by -1 or by a hardcoded substitute, so callers and userspace see
something unrelated to what actually went wrong. The fixes are
independent of each other.

Patch 1 is different from the rest: there the error is not just
mislabelled, it is not seen as an error at all. -1 is what a normal
comparison returns for "collates before", so ntfs_ie_lookup() acts on it
as a tree-descent hint, and a malformed entry in $Reparse/$R or $ObjId/$O
is silently treated as a lookup miss instead of being reported.

Patches 2 and 3 fix -1 returns in inode.c that reach userspace as EPERM.
Patch 3 loses ENOSPC among others, so a full volume misreports create(),
mkdir() and link().

Patches 4 and 5 restore errors that are already available as an ERR_PTR.
Both collapse -ENOMEM into something else, so an allocation failure is
misreported.

No control flow is changed; every callee already returned these codes.

Based on ntfs-next (0fecc393f206).

Baolin Liu (5):
  ntfs: return -EINVAL from ntfs_collate_ntofs_ulongs() on bad length
  ntfs: return -ENOMEM from ntfs_inode_attach_all_extents()
  ntfs: preserve the truncate error in ntfs_enlarge_attribute()
  ntfs: propagate the map_mft_record() error in
    ntfs_attrlist_entry_add()
  ntfs: propagate the ntfs_attr_iget() error in update_reparse_data()

 fs/ntfs/attrlist.c | 4 ++--
 fs/ntfs/collate.c  | 2 +-
 fs/ntfs/inode.c    | 7 ++++---
 fs/ntfs/reparse.c  | 2 +-
 4 files changed, 8 insertions(+), 7 deletions(-)

-- 
2.51.0

[PATCH 1/5] ntfs: return -EINVAL from ntfs_collate_ntofs_ulongs() on bad length

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

ntfs_collate_ntofs_ulongs() returns -1 when the key lengths differ or are
not a multiple of 4. But -1 is also what cmp_int() returns for "collates
before", so the error is indistinguishable from an ordinary result.

ntfs_ie_lookup() acts on that difference: it maps -EINVAL to -ERANGE, but
treats -1 as a tree-descent hint and breaks out of the loop. A malformed
entry in $Reparse/$R or $ObjId/$O is therefore silently taken as a lookup
miss.

Return -EINVAL, as the sibling ntfs_collate_ntofs_ulong() already does.
Well-formed keys are unaffected; both indexes use key sizes that are
multiples of 4.

Fixes: 5218cd102aec ("ntfs: update misc operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
---
 fs/ntfs/collate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs/collate.c b/fs/ntfs/collate.c
index 77e34038902d..744fdfd7bf58 100644
--- a/fs/ntfs/collate.c
+++ b/fs/ntfs/collate.c
@@ -73,7 +73,7 @@ static int ntfs_collate_ntofs_ulongs(struct ntfs_volume *vol,
 
 	if (data1_len != data2_len || data1_len & 3) {
 		ntfs_error(vol->sb, "data1_len or data2_len not valid\n");
-		return -1;
+		return -EINVAL;
 	}
 
 	len = data1_len;
-- 
2.51.0

[PATCH 2/5] ntfs: return -ENOMEM from ntfs_inode_attach_all_extents()

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

ntfs_inode_attach_all_extents() returns -1 when ntfs_extent_inode_open()
fails, and both callers propagate it unchanged, so userspace sees EPERM
from setxattr, reparse point creation and directory index updates on
inodes with an attribute list.

Both paths that return NULL here are allocation failures: the
kmem_cache_alloc() in ntfs_new_extent_inode() and the kvzalloc() that
grows ext.extent_ntfs_inos[]. Return -ENOMEM.

Fixes: af0db57d4293 ("ntfs: update inode operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
---
 fs/ntfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index 5aedc045f65a..747a60ae27c9 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -3025,7 +3025,7 @@ int ntfs_inode_attach_all_extents(struct ntfs_inode *ni)
 				prev_attached != MREF_LE(ale->mft_reference)) {
 			if (!ntfs_extent_inode_open(ni, ale->mft_reference)) {
 				ntfs_debug("Couldn't attach extent inode.\n");
-				return -1;
+				return -ENOMEM;
 			}
 			prev_attached = MREF_LE(ale->mft_reference);
 		}
-- 
2.51.0

Re: [PATCH 2/5] ntfs: return -ENOMEM from ntfs_inode_attach_all_extents()

[Hyunchul Lee]

On Wed, Sep 02, 2026 at 03:32:46PM +0800, Baolin Liu wrote:
> From: Baolin Liu <liubaolin@kylinos.cn>
> 
> ntfs_inode_attach_all_extents() returns -1 when ntfs_extent_inode_open()
> fails, and both callers propagate it unchanged, so userspace sees EPERM
> from setxattr, reparse point creation and directory index updates on
> inodes with an attribute list.
> 
> Both paths that return NULL here are allocation failures: the
> kmem_cache_alloc() in ntfs_new_extent_inode() and the kvzalloc() that
> grows ext.extent_ntfs_inos[]. Return -ENOMEM.
> 
> Fixes: af0db57d4293 ("ntfs: update inode operations")
> Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
> ---
>  fs/ntfs/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
> index 5aedc045f65a..747a60ae27c9 100644
> --- a/fs/ntfs/inode.c
> +++ b/fs/ntfs/inode.c
> @@ -3025,7 +3025,7 @@ int ntfs_inode_attach_all_extents(struct ntfs_inode *ni)
>  				prev_attached != MREF_LE(ale->mft_reference)) {
>  			if (!ntfs_extent_inode_open(ni, ale->mft_reference)) {
>  				ntfs_debug("Couldn't attach extent inode.\n");
> -				return -1;
> +				return -ENOMEM;

Could you also fix the error handling of ntfs_extent_inode_open()?
It treats the failure of map_mft_record() as success. If we would 
fix that, this patch would incorrectly convert every failures to
ENOMEM.

>  			}
>  			prev_attached = MREF_LE(ale->mft_reference);
>  		}
> -- 
> 2.51.0
> 

-- 
Thanks,
Hyunchul

Re: [PATCH 2/5] ntfs: return -ENOMEM from ntfs_inode_attach_all_extents()

[liubaolin]

在 2026/9/3 13:25, Hyunchul Lee 写道:
> On Wed, Sep 02, 2026 at 03:32:46PM +0800, Baolin Liu wrote:
>> From: Baolin Liu <liubaolin@kylinos.cn>
>>
>> ntfs_inode_attach_all_extents() returns -1 when ntfs_extent_inode_open()
>> fails, and both callers propagate it unchanged, so userspace sees EPERM
>> from setxattr, reparse point creation and directory index updates on
>> inodes with an attribute list.
>>
>> Both paths that return NULL here are allocation failures: the
>> kmem_cache_alloc() in ntfs_new_extent_inode() and the kvzalloc() that
>> grows ext.extent_ntfs_inos[]. Return -ENOMEM.
>>
>> Fixes: af0db57d4293 ("ntfs: update inode operations")
>> Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
>> ---
>>   fs/ntfs/inode.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
>> index 5aedc045f65a..747a60ae27c9 100644
>> --- a/fs/ntfs/inode.c
>> +++ b/fs/ntfs/inode.c
>> @@ -3025,7 +3025,7 @@ int ntfs_inode_attach_all_extents(struct ntfs_inode *ni)
>>   				prev_attached != MREF_LE(ale->mft_reference)) {
>>   			if (!ntfs_extent_inode_open(ni, ale->mft_reference)) {
>>   				ntfs_debug("Couldn't attach extent inode.\n");
>> -				return -1;
>> +				return -ENOMEM;
> 
> Could you also fix the error handling of ntfs_extent_inode_open()?
> It treats the failure of map_mft_record() as success. If we would
> fix that, this patch would incorrectly convert every failures to
> ENOMEM.
> 
>>   			}
>>   			prev_attached = MREF_LE(ale->mft_reference);
>>   		}
>> -- 
>> 2.51.0
>>
> 

Hi Hyunchul,

   Thanks for the review.

   I'll fix both issues you mentioned in v2 and send it soon.

Thanks,
Baolin

Re: [PATCH 2/5] ntfs: return -ENOMEM from ntfs_inode_attach_all_extents()

[Hyunchul Lee]

> Hi Hyunchul,
> 
>    Thanks for the review.
> 
>    I'll fix both issues you mentioned in v2 and send it soon.

And the other patches look good to me, so feel free to add my
Reviewed-by tag to them.

Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>

> 
> Thanks,
> Baolin
> 
> 

-- 
Thanks,
Hyunchul

[PATCH 3/5] ntfs: preserve the truncate error in ntfs_enlarge_attribute()

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

ntfs_enlarge_attribute() discards the error from ntfs_attr_truncate() and
returns -1, which reaches userspace as EPERM. The discarded codes are
meaningful: -ENOSPC when the attribute cannot grow, -EACCES when it is
encrypted, -EOPNOTSUPP when compressed, plus -EINVAL and -ENOMEM.

Most callers of ntfs_inode_attr_pwrite() compare the result against the
requested length and substitute -EIO, masking this. ntfs_ib_write() does
not; it returns the value verbatim, which propagates through
ntfs_index_add_filename() to __ntfs_create() and __ntfs_link(), so a full
volume reports EPERM instead of ENOSPC from create(), mkdir() and link().

Fixes: af0db57d4293 ("ntfs: update inode operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
---
 fs/ntfs/inode.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index 747a60ae27c9..9b2ff15da94c 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -3618,9 +3618,10 @@ static inline int ntfs_enlarge_attribute(struct inode *vi, s64 pos, s64 count,
 		return -EOPNOTSUPP;
 
 	if (pos + count > ni->data_size) {
-		if (ntfs_attr_truncate(ni, pos + count)) {
+		ret = ntfs_attr_truncate(ni, pos + count);
+		if (ret) {
 			ntfs_debug("Failed to truncate attribute");
-			return -1;
+			return ret;
 		}
 
 		ntfs_attr_reinit_search_ctx(ctx);
-- 
2.51.0

[PATCH 4/5] ntfs: propagate the map_mft_record() error in ntfs_attrlist_entry_add()

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

ntfs_attrlist_entry_add() replaces the map_mft_record() error with -EIO,
so an -ENOMEM allocation failure is reported as an I/O error. Both
callers pass the value on to ntfs_attr_add(), which no longer collapses
it since commit 8efe00b098b5 ("ntfs: preserve error code in
ntfs_resident_attr_record_add()").

Return PTR_ERR(ni_mrec) instead. Also fix the debug message.

Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
---
 fs/ntfs/attrlist.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs/attrlist.c b/fs/ntfs/attrlist.c
index be3086d34338..a1c00e426e80 100644
--- a/fs/ntfs/attrlist.c
+++ b/fs/ntfs/attrlist.c
@@ -139,8 +139,8 @@ int ntfs_attrlist_entry_add(struct ntfs_inode *ni, struct attr_record *attr)
 
 	ni_mrec = map_mft_record(ni);
 	if (IS_ERR(ni_mrec)) {
-		ntfs_debug("Invalid arguments.\n");
-		return -EIO;
+		ntfs_debug("Failed to map mft record.\n");
+		return PTR_ERR(ni_mrec);
 	}
 
 	mref = MK_LE_MREF(ni->mft_no, le16_to_cpu(ni_mrec->sequence_number));
-- 
2.51.0

[PATCH 5/5] ntfs: propagate the ntfs_attr_iget() error in update_reparse_data()

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

update_reparse_data() replaces the ntfs_attr_iget() error with -EINVAL,
so an -ENOMEM from iget5_locked() or a read failure from
ntfs_read_locked_attr_inode() is reported to userspace as EINVAL.

The path is reached from __ntfs_create() via the three
ntfs_reparse_set_*() helpers, so symlink() and mknod() are affected.

Return PTR_ERR(rp_inode) instead.

Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
---
 fs/ntfs/reparse.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs/reparse.c b/fs/ntfs/reparse.c
index 1a6073e22677..2a6480211fe3 100644
--- a/fs/ntfs/reparse.c
+++ b/fs/ntfs/reparse.c
@@ -676,7 +676,7 @@ static int update_reparse_data(struct ntfs_inode *ni, struct ntfs_index_context
 
 	rp_inode = ntfs_attr_iget(VFS_I(ni), AT_REPARSE_POINT, AT_UNNAMED, 0);
 	if (IS_ERR(rp_inode))
-		return -EINVAL;
+		return PTR_ERR(rp_inode);
 	rp_ni = NTFS_I(rp_inode);
 
 	/* remove the existing reparse data */
-- 
2.51.0