Re: [PATCH] fs/ntfs3: prevent potential lcn remains uninitialized

On 5/26/26 10:08, Edward Adam Davis wrote:

> The target VCN being sought was not found within runs[0], causing
> run_lookup() to return false. This causes run_lookup_entry() to return
> false, which in turn results in a len value of 0, and the new parameter
> passed to attr_data_get_block() is NULL. Collectively, these factors
> ultimately cause attr_data_get_block_locked() to exit prematurely without
> initializing lcn, thereby triggering [1].
>
> To prevent [1], the clen check within ni_seek_data_or_hole() has been
> moved to occur before the lcn check.
>
> [1]
> BUG: KMSAN: uninit-value in ni_seek_data_or_hole+0x24f/0x5f0 fs/ntfs3/frecord.c:2862
>   ni_seek_data_or_hole+0x24f/0x5f0 fs/ntfs3/frecord.c:2862
>   ntfs_llseek+0x22a/0x4a0 fs/ntfs3/file.c:1530
>   vfs_llseek fs/read_write.c:391 [inline]
>
> Fixes: c61326967728 ("fs/ntfs3: implement llseek SEEK_DATA/SEEK_HOLE by scanning data runs")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=c2cfe997245202e46f10
> Signed-off-by: Edward Adam Davis <[email protected]>
> ---
>   fs/ntfs3/frecord.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
> index 7b035da63c12..d511b6a75ae8 100644
> --- a/fs/ntfs3/frecord.c
> +++ b/fs/ntfs3/frecord.c
> @@ -2859,6 +2859,11 @@ loff_t ni_seek_data_or_hole(struct ntfs_inode *ni, loff_t offset, bool data)
>   			return err;
>   		}
>   
> +		if (!clen) {
> +			/* Corrupted file. */
> +			return -EINVAL;
> +		}
> +
>   		if (lcn == RESIDENT_LCN) {
>   			/* clen - resident size in bytes. clen == ni->vfs_inode.i_size */
>   			if (offset >= clen) {
> @@ -2909,10 +2914,6 @@ loff_t ni_seek_data_or_hole(struct ntfs_inode *ni, loff_t offset, bool data)
>   			}
>   		}
>   
> -		if (!clen) {
> -			/* Corrupted file. */
> -			return -EINVAL;
> -		}
>   	}
>   }
>   

Hello,

The patch was applied, thank you.

Regards,
Konstantin