[bug report] fs/ntfs3: Fix OOB write if ret == buf_len in ntfs_utf16_to_nls()

[bug report] fs/ntfs3: Fix OOB write if ret == buf_len in ntfs_utf16_to_nls()

[Dan Carpenter]

Hello Alexandro Calo,

Commit eff11b5a1eac ("fs/ntfs3: Fix OOB write if ret == buf_len in
ntfs_utf16_to_nls()") from Jul 7, 2026 (linux-next), leads to the
following Smatch static checker warning:

	fs/ntfs3/dir.c:37 ntfs_utf16_to_nls()
	warn: inconsistent indenting

fs/ntfs3/dir.c
    19 int ntfs_utf16_to_nls(struct ntfs_sb_info *sbi, const __le16 *name, u32 len,
    20                       u8 *buf, int buf_len)
    21 {
    22         int ret, warn;
    23         u8 *op;
    24         struct nls_table *nls = sbi->options->nls;
    25 
    26         static_assert(sizeof(wchar_t) == sizeof(__le16));
    27 
    28         if (buf_len <= 0)
    29                 return -EINVAL;
    30 
    31         buf_len -= 1;

buf_len represents the sizeof buf - 1.

    32 
    33         if (!nls) {
    34                 /* UTF-16 -> UTF-8 */
    35                 ret = utf16s_to_utf8s((wchar_t *)name, len, UTF16_LITTLE_ENDIAN,
    36                                       buf, buf_len);
--> 37         if (ret >= buf_len) {
    38             ret = buf_len-1;
    39         }

So this is wrong because we're now putting a NULL in buf[len - 2].
This patch should just be reverted.  The original was correct and
the new code is buggy.

    40                 buf[ret] = '\0';
    41                 return ret;
    42         }
    43 
    44         op = buf;

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter