From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 35DCA370ACD for ; Sun, 12 Jul 2026 13:34:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783863288; cv=none; b=ftxaJdnNgT9OqDhXI15ExzC2QGpvxIx+7f20UZCRaBbSJIYoE8C+zMOLmnx1WfS1CjDXEQbEFo7Gi1/n3NhuOuT50Du6Wi51bABgFUmgvBx3O3OT21N0XqIchuGXWoOChgkLCV4Y1StybHVkZlquzXh/fJOJfgsWgapUOIA4f2c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783863288; c=relaxed/simple; bh=SRX9mHeiwzKQkz+Dne4S1XGxWnRHLWPmixGyWmOgWHI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gEPsx3mRZ/iipR/PzPgO7zY6mFaFnXx3Jytc0bsHEMD0ricq2bbpyxOp2SZtXFtJ+rDt759+SEUygvpcXlEe5P6vlSAOQWYeNGwWDX0AKptUrtxj/DbSTe/i8+0QpQXGZgk+g3WyBE9STfyIZad7FhEIhmCQkoUEppLxjTlmqOI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Y5BLVyLp; arc=none smtp.client-ip=209.85.216.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Y5BLVyLp" Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-38a0c7e841fso2722578a91.2 for ; Sun, 12 Jul 2026 06:34:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783863286; x=1784468086; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Tonu3RNgJXI3ufg6NmZZ2X740hE2BOXsOBfoXwm3l2o=; b=Y5BLVyLpCe3FWU+m5Puu2d4wZnCN88Bg4qxy/xe4Jt+TiN/FfuH/18v19cprU6oeD+ 4QLamw7gls/3RQ2vh6J8pdbQm88bci4KVRk7t0Q6AgW8ANfFqjfqiCWJwK8WGT2Ed7YR 9hsqeYeZRDjZTUKBAIVGFQwPFaGolvLHifQOdyqRpkkphaJvg20g8bB3ZDFhh6FZ2qNG 1McjxYLTiHp0Hbie6t20votvTek5iQjLC444GDBSooaUDQBOWxEyM90S4d+8cbfaSDLY lHIX8Bv8Ti9WgUqoIZdHnj4+2qv9PnOvwacLGVzIXEPBHV/k7ImePShgZKY2WUzken+k +3xQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783863286; x=1784468086; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Tonu3RNgJXI3ufg6NmZZ2X740hE2BOXsOBfoXwm3l2o=; b=iNwK8nT7OlvfIGIOb/NUZo+fGIhoZMMjiSFLrmRbVwx/T8DN1kuKN++cR9Rb6/uxPh swZYnRQUoWO+VcqbQWsT4pmBjlFQ9xnxqgX9naWtLjt4Q+4rGOB5T3Hu4EunKgXxD2/3 Qxy5hre7acYkieklyUT9tjVgi18DrGt0lRz8GMhZhARgceJComBbrcRCj9qY77UgM2/d FCz6mx6llyvHTnBqanCo/wBjU6jgq8t0JawcC5PInfCtNZtuHlwyrieKoWzYlx/Vohxd VtS7YcEcNGHcL1O7Q4arBWl/NzDCk/Geky3TB581CUVG1S4eFPO5Qjcc9XipheNRcMfL mwEA== X-Forwarded-Encrypted: i=1; AHgh+Rqam7VHK6r2fCJxofpjjxssvfGz6ZgSTfdP+R6SoAGSXQaM3+rMgqSH0Gyidj+ZXg5lRxG5VBKWakwugqc=@vger.kernel.org X-Gm-Message-State: AOJu0Ywp4rjrzpZin0NW1R4W2+hUeOu9IYfH3qXMmgu9wBlcv8/BIrP9 7Swn7Y4gkOWlEc/DWcWiLiG33AurYiqvsT/DorqKQ3AyknxOOQgwQbxC X-Gm-Gg: AfdE7cn9Nu5cJcUTbdMmn4rr3oL9zZ5M0oujUcyyJqqktc96kRVt5Qcm63KKerwbBlJ 7iKbr3zwXCPahMK6rmKqTOdAYmu3TjOreqarryFADx7otd0f+mZZCW0+DwgAAEMnja6ET+gLGx9 Xa4jFShtdqhI3WVAH68S0hQBV2tGrRkvnM1/ZUV7UZpBNy7YWDhGqM5F2koXXTVHHFbwDLTVciJ 2Ptlvr3Nbk1JaPoKlOWZsw+tnn8Xcz/xco4mXSha6hcqMugyrxdiu2nOgq4tJoYALoXjeN1dL0P 1L64DVU2sB/SdqQ+jV5FC4TvGR6seCw4O5DEaqlfr8CgejcU14m9AVAvlKWiQiB+71IU4hw9d04 N4o03si6P3Q8FXy+Ue74ODQS8J1lQyfxOX52qgqfXfYo3FN9xKQRlttHouD7FHrE8js96RaphFg UGN8ifn8o/yNAtcsYaU1kR2cDnnFgHbrFKRBXm0UH3KEtxpPCNAF4e1L0yOu1CQrEt1R/T X-Received: by 2002:a17:90b:2641:b0:387:e0db:3fab with SMTP id 98e67ed59e1d1-38dc7776ec1mr5836853a91.36.1783863286514; Sun, 12 Jul 2026 06:34:46 -0700 (PDT) Received: from fx.tailc0aff1.ts.net ([206.206.192.132]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-313b9ca880fsm19813101eec.23.2026.07.12.06.34.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 06:34:45 -0700 (PDT) From: Weiming Shi To: Konstantin Komarov Cc: ntfs3@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Xiang Mei , Weiming Shi Subject: [PATCH] fs/ntfs3: do not mark frame pages uptodate on read error Date: Sun, 12 Jul 2026 06:34:26 -0700 Message-ID: <20260712133427.435377-2-bestswngs@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ni_read_frame() ends with a loop that marks every page of a compressed frame uptodate regardless of whether the read succeeded: out: for (i = 0; i < pages_per_frame; i++) { pg = pages[i]; SetPageUptodate(pg); } Non-critical frame pages come from __filemap_get_folio(FGP_CREAT) and are not zeroed. On an error path that reaches out: before frame_mem is written, these pages keep uninitialized page-allocator contents but are still marked uptodate. A later read() is then served from the page cache and returns that stale kernel memory to user space. For an unprivileged user mounting a crafted NTFS image this is a repeatable kernel memory disclosure. Mark the pages uptodate only on success; on error leave them !uptodate so the read path re-reads them or reports the error. Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Reported-by: Xiang Mei Signed-off-by: Weiming Shi --- fs/ntfs3/frecord.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index 2d2644d80017..862baafb80e3 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -2467,7 +2467,8 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages, out: for (i = 0; i < pages_per_frame; i++) { pg = pages[i]; - SetPageUptodate(pg); + if (!err) + SetPageUptodate(pg); } return err; -- 2.43.0