[PATCH v2 0/5] ntfs: fix incorrect error codes returned to callers

[PATCH v2 0/5] ntfs: fix incorrect error codes returned to callers

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

Changes in v2:
- Patch 2: Fixed ntfs_extent_inode_open() to use ERR_PTR() instead of NULL,
  so it can properly propagate error codes (suggested by maintainer).
  Updated ntfs_inode_attach_all_extents() to use IS_ERR()/PTR_ERR() to
  preserve the actual error code from ntfs_extent_inode_open().
- Patches 1, 3, 4, 5: No code changes, added Reviewed-by tag from Hyunchul Lee

Five places in fs/ntfs/ return the wrong error code: a real errno is
replaced by -1 or by a hardcoded substitute, so callers and userspace see
something unrelated to what actually went wrong. The fixes are
independent of each other.

Patch 1 is different from the rest: there the error is not just
mislabelled, it is not seen as an error at all. -1 is what a normal
comparison returns for "collates before", so ntfs_ie_lookup() acts on it
as a tree-descent hint, and a malformed entry in $Reparse/$R or $ObjId/$O
is silently treated as a lookup miss instead of being reported.

Patch 2 fixes ntfs_extent_inode_open() which had two bugs: it treated
map_mft_record() failure as success, and returned NULL for all errors
(losing error information). Now it returns ERR_PTR() with the actual
error code (-EIO, -ENOMEM, -EINVAL).

Patch 3 fixes a -1 return in inode.c that reaches userspace as EPERM.
It loses ENOSPC among others, so a full volume misreports create(),
mkdir() and link().

Patches 4 and 5 restore errors that are already available as an ERR_PTR.
Both collapse -ENOMEM into something else, so an allocation failure is
misreported.

No control flow is changed; every callee already returned these codes.

Based on ntfs-next (0fecc393f206).

Baolin Liu (5):
  ntfs: return -EINVAL from ntfs_collate_ntofs_ulongs() on bad length
  ntfs: fix error handling in ntfs_extent_inode_open and propagate errors
  ntfs: preserve the truncate error in ntfs_enlarge_attribute()
  ntfs: propagate the map_mft_record() error in ntfs_attrlist_entry_add()
  ntfs: propagate the ntfs_attr_iget() error in update_reparse_data()

 fs/ntfs/attrlist.c |  4 ++--
 fs/ntfs/collate.c  |  2 +-
 fs/ntfs/inode.c    | 28 ++++++++++++++++++----------
 fs/ntfs/reparse.c  |  2 +-
 4 files changed, 22 insertions(+), 14 deletions(-)

--
2.51.0

[PATCH v2 1/5] ntfs: return -EINVAL from ntfs_collate_ntofs_ulongs() on bad length

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

ntfs_collate_ntofs_ulongs() returns -1 when the key lengths differ or are
not a multiple of 4. But -1 is also what cmp_int() returns for "collates
before", so the error is indistinguishable from an ordinary result.

ntfs_ie_lookup() acts on that difference: it maps -EINVAL to -ERANGE, but
treats -1 as a tree-descent hint and breaks out of the loop. A malformed
entry in $Reparse/$R or $ObjId/$O is therefore silently taken as a lookup
miss.

Return -EINVAL, as the sibling ntfs_collate_ntofs_ulong() already does.
Well-formed keys are unaffected; both indexes use key sizes that are
multiples of 4.

Fixes: 5218cd102aec ("ntfs: update misc operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
---
 fs/ntfs/collate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs/collate.c b/fs/ntfs/collate.c
index 77e34038902d..744fdfd7bf58 100644
--- a/fs/ntfs/collate.c
+++ b/fs/ntfs/collate.c
@@ -73,7 +73,7 @@ static int ntfs_collate_ntofs_ulongs(struct ntfs_volume *vol,
 
 	if (data1_len != data2_len || data1_len & 3) {
 		ntfs_error(vol->sb, "data1_len or data2_len not valid\n");
-		return -1;
+		return -EINVAL;
 	}
 
 	len = data1_len;
-- 
2.51.0

[PATCH v2 2/5] ntfs: fix error handling in ntfs_extent_inode_open and propagate errors

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

ntfs_extent_inode_open() has two issues:

1. When map_mft_record() fails, it returns the non-NULL 'ni' pointer
   instead of an error, causing the caller to treat the failure as success.

2. It returns NULL for all errors, losing information about what actually
   went wrong (-EIO, -ENOMEM, -EINVAL, etc.).

Fix both by converting the function to return ERR_PTR() on error, and
update the single caller (ntfs_inode_attach_all_extents) to check with
IS_ERR() and propagate the actual error code with PTR_ERR().

Fixes: af0db57d4293 ("ntfs: update inode operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
---
 fs/ntfs/inode.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index 5aedc045f65a..xxxxxxxxxxxx 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -2904,8 +2904,7 @@ static inline void ntfs_init_big_inode(struct inode *vi)
  * abort if deprotection or checks fail.
  *
  * Finally attach the ntfs inode to its base inode @base_ni and return a
- * pointer to the ntfs_inode structure on success or NULL on error, with errno
- * set to the error code.
+ * pointer to the ntfs_inode structure on success or ERR_PTR() on error.
  *
  * Note, extent inodes are never closed directly. They are automatically
  * disposed off by the closing of the base inode.
@@ -2921,7 +2920,7 @@ static struct ntfs_inode *ntfs_extent_inode_open(struct ntfs_inode *base_ni,
 	struct super_block *sb;

 	if (!base_ni)
-		return NULL;
+		return ERR_PTR(-EINVAL);

 	sb = base_ni->vol->sb;
 	ntfs_debug("Opening extent inode %llu (base mft record %llu).\n",
@@ -2940,7 +2939,7 @@ static struct ntfs_inode *ntfs_extent_inode_open(struct ntfs_inode *base_ni,
 			if (IS_ERR(ni_mrec)) {
 				ntfs_error(sb, "failed to map mft record for %llu",
 						ni->mft_no);
-				goto out;
+				return ERR_PTR(PTR_ERR(ni_mrec));
 			}
 			/* Verify the sequence number if given. */
 			seq_no = MSEQNO_LE(mref);
@@ -2949,7 +2948,7 @@ static struct ntfs_inode *ntfs_extent_inode_open(struct ntfs_inode *base_ni,
 				ntfs_error(sb, "Found stale extent mft reference mft=%llu",
 						ni->mft_no);
 				unmap_mft_record(ni);
-				goto out;
+				return ERR_PTR(-EINVAL);
 			}
 			unmap_mft_record(ni);
 			goto out;
@@ -2958,7 +2957,7 @@ static struct ntfs_inode *ntfs_extent_inode_open(struct ntfs_inode *base_ni,
 	/* Wasn't there, we need to load the extent inode. */
 	ni = ntfs_new_extent_inode(base_ni->vol->sb, mft_no);
 	if (!ni)
-		goto out;
+		return ERR_PTR(-ENOMEM);

 	ni->seq_no = (u16)MSEQNO_LE(mref);
 	ni->nr_extents = -1;
@@ -2968,8 +2967,10 @@ static struct ntfs_inode *ntfs_extent_inode_open(struct ntfs_inode *base_ni,
 		i = (base_ni->nr_extents + 4) * sizeof(struct ntfs_inode *);

 		extent_nis = kvzalloc(i, GFP_NOFS);
-		if (!extent_nis)
+		if (!extent_nis) {
+			ni = ERR_PTR(-ENOMEM);
 			goto err_out;
+		}
 		if (base_ni->nr_extents) {
 			memcpy(extent_nis, base_ni->ext.extent_ntfs_inos,
 					i - 4 * sizeof(struct ntfs_inode *));
@@ -2984,7 +2985,6 @@ static struct ntfs_inode *ntfs_extent_inode_open(struct ntfs_inode *base_ni,
 	return ni;
 err_out:
 	ntfs_destroy_ext_inode(ni);
-	ni = NULL;
 	goto out;
 }

@@ -3025,9 +3025,12 @@ int ntfs_inode_attach_all_extents(struct ntfs_inode *ni)
 	while ((u8 *)ale < ni->attr_list + ni->attr_list_size) {
 		if (ni->mft_no != MREF_LE(ale->mft_reference) &&
 				prev_attached != MREF_LE(ale->mft_reference)) {
-			if (!ntfs_extent_inode_open(ni, ale->mft_reference)) {
+			struct ntfs_inode *ext_ni;
+
+			ext_ni = ntfs_extent_inode_open(ni, ale->mft_reference);
+			if (IS_ERR(ext_ni)) {
 				ntfs_debug("Couldn't attach extent inode.\n");
-				return -1;
+				return PTR_ERR(ext_ni);
 			}
 			prev_attached = MREF_LE(ale->mft_reference);
 		}
--
2.51.0

[PATCH v2 3/5] ntfs: preserve the truncate error in ntfs_enlarge_attribute()

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

ntfs_enlarge_attribute() discards the error from ntfs_attr_truncate() and
returns -1, which reaches userspace as EPERM. The discarded codes are
meaningful: -ENOSPC when the attribute cannot grow, -EACCES when it is
encrypted, -EOPNOTSUPP when compressed, plus -EINVAL and -ENOMEM.

Most callers of ntfs_inode_attr_pwrite() compare the result against the
requested length and substitute -EIO, masking this. ntfs_ib_write() does
not; it returns the value verbatim, which propagates through
ntfs_index_add_filename() to __ntfs_create() and __ntfs_link(), so a full
volume reports EPERM instead of ENOSPC from create(), mkdir() and link().

Fixes: af0db57d4293 ("ntfs: update inode operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
---
 fs/ntfs/inode.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index 747a60ae27c9..9b2ff15da94c 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -3618,9 +3618,10 @@ static inline int ntfs_enlarge_attribute(struct inode *vi, s64 pos, s64 count,
 		return -EOPNOTSUPP;
 
 	if (pos + count > ni->data_size) {
-		if (ntfs_attr_truncate(ni, pos + count)) {
+		ret = ntfs_attr_truncate(ni, pos + count);
+		if (ret) {
 			ntfs_debug("Failed to truncate attribute");
-			return -1;
+			return ret;
 		}
 
 		ntfs_attr_reinit_search_ctx(ctx);
-- 
2.51.0

[PATCH v2 4/5] ntfs: propagate the map_mft_record() error in ntfs_attrlist_entry_add()

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

ntfs_attrlist_entry_add() replaces the map_mft_record() error with -EIO,
so an -ENOMEM allocation failure is reported as an I/O error. Both
callers pass the value on to ntfs_attr_add(), which no longer collapses
it since commit 8efe00b098b5 ("ntfs: preserve error code in
ntfs_resident_attr_record_add()").

Return PTR_ERR(ni_mrec) instead. Also fix the debug message.

Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
---
 fs/ntfs/attrlist.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs/attrlist.c b/fs/ntfs/attrlist.c
index be3086d34338..a1c00e426e80 100644
--- a/fs/ntfs/attrlist.c
+++ b/fs/ntfs/attrlist.c
@@ -139,8 +139,8 @@ int ntfs_attrlist_entry_add(struct ntfs_inode *ni, struct attr_record *attr)
 
 	ni_mrec = map_mft_record(ni);
 	if (IS_ERR(ni_mrec)) {
-		ntfs_debug("Invalid arguments.\n");
-		return -EIO;
+		ntfs_debug("Failed to map mft record.\n");
+		return PTR_ERR(ni_mrec);
 	}
 
 	mref = MK_LE_MREF(ni->mft_no, le16_to_cpu(ni_mrec->sequence_number));
-- 
2.51.0

[PATCH v2 5/5] ntfs: propagate the ntfs_attr_iget() error in update_reparse_data()

[Baolin Liu]

From: Baolin Liu <liubaolin@kylinos.cn>

update_reparse_data() replaces the ntfs_attr_iget() error with -EINVAL,
so an -ENOMEM from iget5_locked() or a read failure from
ntfs_read_locked_attr_inode() is reported to userspace as EINVAL.

The path is reached from __ntfs_create() via the three
ntfs_reparse_set_*() helpers, so symlink() and mknod() are affected.

Return PTR_ERR(rp_inode) instead.

Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
---
 fs/ntfs/reparse.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs/reparse.c b/fs/ntfs/reparse.c
index 1a6073e22677..2a6480211fe3 100644
--- a/fs/ntfs/reparse.c
+++ b/fs/ntfs/reparse.c
@@ -676,7 +676,7 @@ static int update_reparse_data(struct ntfs_inode *ni, struct ntfs_index_context
 
 	rp_inode = ntfs_attr_iget(VFS_I(ni), AT_REPARSE_POINT, AT_UNNAMED, 0);
 	if (IS_ERR(rp_inode))
-		return -EINVAL;
+		return PTR_ERR(rp_inode);
 	rp_ni = NTFS_I(rp_inode);
 
 	/* remove the existing reparse data */
-- 
2.51.0

Re: [PATCH v2 2/5] ntfs: fix error handling in ntfs_extent_inode_open and propagate errors

[Namjae Jeon]

> @@ -2968,8 +2967,10 @@ static struct ntfs_inode *ntfs_extent_inode_open(struct ntfs_inode *base_ni,
>                 i = (base_ni->nr_extents + 4) * sizeof(struct ntfs_inode *);
>
>                 extent_nis = kvzalloc(i, GFP_NOFS);
> -               if (!extent_nis)
> +               if (!extent_nis) {
> +                       ni = ERR_PTR(-ENOMEM);
It overwrites ni with ERR_PTR(-ENOMEM). ntfs_destroy_ext_inode() must
be called before doing so.

>                         goto err_out;
> +               }
>                 if (base_ni->nr_extents) {
>                         memcpy(extent_nis, base_ni->ext.extent_ntfs_inos,
>                                         i - 4 * sizeof(struct ntfs_inode *));

Re: [PATCH v2 0/5] ntfs: fix incorrect error codes returned to callers

[Namjae Jeon]

On Fri, Sep 4, 2026 at 6:01 PM Baolin Liu <liubaolin12138@163.com> wrote:
>
> From: Baolin Liu <liubaolin@kylinos.cn>
>
> Changes in v2:
> - Patch 2: Fixed ntfs_extent_inode_open() to use ERR_PTR() instead of NULL,
>   so it can properly propagate error codes (suggested by maintainer).
>   Updated ntfs_inode_attach_all_extents() to use IS_ERR()/PTR_ERR() to
>   preserve the actual error code from ntfs_extent_inode_open().
> - Patches 1, 3, 4, 5: No code changes, added Reviewed-by tag from Hyunchul Lee
>
> Five places in fs/ntfs/ return the wrong error code: a real errno is
> replaced by -1 or by a hardcoded substitute, so callers and userspace see
> something unrelated to what actually went wrong. The fixes are
> independent of each other.
>
> Patch 1 is different from the rest: there the error is not just
> mislabelled, it is not seen as an error at all. -1 is what a normal
> comparison returns for "collates before", so ntfs_ie_lookup() acts on it
> as a tree-descent hint, and a malformed entry in $Reparse/$R or $ObjId/$O
> is silently treated as a lookup miss instead of being reported.
>
> Patch 2 fixes ntfs_extent_inode_open() which had two bugs: it treated
> map_mft_record() failure as success, and returned NULL for all errors
> (losing error information). Now it returns ERR_PTR() with the actual
> error code (-EIO, -ENOMEM, -EINVAL).
>
> Patch 3 fixes a -1 return in inode.c that reaches userspace as EPERM.
> It loses ENOSPC among others, so a full volume misreports create(),
> mkdir() and link().
>
> Patches 4 and 5 restore errors that are already available as an ERR_PTR.
> Both collapse -ENOMEM into something else, so an allocation failure is
> misreported.
>
> No control flow is changed; every callee already returned these codes.
>
> Based on ntfs-next (0fecc393f206).
>
> Baolin Liu (5):
>   ntfs: return -EINVAL from ntfs_collate_ntofs_ulongs() on bad length
>   ntfs: fix error handling in ntfs_extent_inode_open and propagate errors
>   ntfs: preserve the truncate error in ntfs_enlarge_attribute()
>   ntfs: propagate the map_mft_record() error in ntfs_attrlist_entry_add()
>   ntfs: propagate the ntfs_attr_iget() error in update_reparse_data()
Applied them to #ntfs-next except 0002 patch("ntfs: fix error handling
in ntfs_extent_inode_open and propagate errors").
Thanks!

Re: [PATCH v2 2/5] ntfs: fix error handling in ntfs_extent_inode_open and propagate errors

[liubaolin]

在 2026/9/4 22:20, Namjae Jeon 写道:
>> @@ -2968,8 +2967,10 @@ static struct ntfs_inode *ntfs_extent_inode_open(struct ntfs_inode *base_ni,
>>                  i = (base_ni->nr_extents + 4) * sizeof(struct ntfs_inode *);
>>
>>                  extent_nis = kvzalloc(i, GFP_NOFS);
>> -               if (!extent_nis)
>> +               if (!extent_nis) {
>> +                       ni = ERR_PTR(-ENOMEM);
> It overwrites ni with ERR_PTR(-ENOMEM). ntfs_destroy_ext_inode() must
> be called before doing so.
> 
>>                          goto err_out;
>> +               }
>>                  if (base_ni->nr_extents) {
>>                          memcpy(extent_nis, base_ni->ext.extent_ntfs_inos,
>>                                          i - 4 * sizeof(struct ntfs_inode *));

Hi Namjae,

   Thanks for the review!

   Sorry, that was my oversight. I should call 
ntfs_destroy_ext_inode(ni) first and then return ERR_PTR(-ENOMEM) directly.

   I'll send v3 soon.

Thanks,
Baolin.

Re: [PATCH v2 0/5] ntfs: fix incorrect error codes returned to callers

[liubaolin]

在 2026/9/4 22:22, Namjae Jeon 写道:
> On Fri, Sep 4, 2026 at 6:01 PM Baolin Liu <liubaolin12138@163.com> wrote:
>>
>> From: Baolin Liu <liubaolin@kylinos.cn>
>>
>> Changes in v2:
>> - Patch 2: Fixed ntfs_extent_inode_open() to use ERR_PTR() instead of NULL,
>>    so it can properly propagate error codes (suggested by maintainer).
>>    Updated ntfs_inode_attach_all_extents() to use IS_ERR()/PTR_ERR() to
>>    preserve the actual error code from ntfs_extent_inode_open().
>> - Patches 1, 3, 4, 5: No code changes, added Reviewed-by tag from Hyunchul Lee
>>
>> Five places in fs/ntfs/ return the wrong error code: a real errno is
>> replaced by -1 or by a hardcoded substitute, so callers and userspace see
>> something unrelated to what actually went wrong. The fixes are
>> independent of each other.
>>
>> Patch 1 is different from the rest: there the error is not just
>> mislabelled, it is not seen as an error at all. -1 is what a normal
>> comparison returns for "collates before", so ntfs_ie_lookup() acts on it
>> as a tree-descent hint, and a malformed entry in $Reparse/$R or $ObjId/$O
>> is silently treated as a lookup miss instead of being reported.
>>
>> Patch 2 fixes ntfs_extent_inode_open() which had two bugs: it treated
>> map_mft_record() failure as success, and returned NULL for all errors
>> (losing error information). Now it returns ERR_PTR() with the actual
>> error code (-EIO, -ENOMEM, -EINVAL).
>>
>> Patch 3 fixes a -1 return in inode.c that reaches userspace as EPERM.
>> It loses ENOSPC among others, so a full volume misreports create(),
>> mkdir() and link().
>>
>> Patches 4 and 5 restore errors that are already available as an ERR_PTR.
>> Both collapse -ENOMEM into something else, so an allocation failure is
>> misreported.
>>
>> No control flow is changed; every callee already returned these codes.
>>
>> Based on ntfs-next (0fecc393f206).
>>
>> Baolin Liu (5):
>>    ntfs: return -EINVAL from ntfs_collate_ntofs_ulongs() on bad length
>>    ntfs: fix error handling in ntfs_extent_inode_open and propagate errors
>>    ntfs: preserve the truncate error in ntfs_enlarge_attribute()
>>    ntfs: propagate the map_mft_record() error in ntfs_attrlist_entry_add()
>>    ntfs: propagate the ntfs_attr_iget() error in update_reparse_data()
> Applied them to #ntfs-next except 0002 patch("ntfs: fix error handling
> in ntfs_extent_inode_open and propagate errors").
> Thanks!

Hi Namjae,

   Thanks for applying them.I'll send the 0002 patch alone as v3.

Thanks,
Baolin.