github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fs/ntfs3: do not mark frame pages uptodate on read error

Browse Source 
ni_read_frame() ends with a loop that marks every page of a compressed
frame uptodate regardless of whether the read succeeded:

	out:
		for (i = 0; i < pages_per_frame; i++) {
			pg = pages[i];
			SetPageUptodate(pg);
		}

Non-critical frame pages come from __filemap_get_folio(FGP_CREAT) and are
not zeroed. On an error path that reaches out: before frame_mem is
written, these pages keep uninitialized page-allocator contents but are
still marked uptodate. A later read() is then served from the page cache
and returns that stale kernel memory to user space.

For an unprivileged user mounting a crafted NTFS image this is a
repeatable kernel memory disclosure.

Mark the pages uptodate only on success; on error leave them !uptodate so
the read path re-reads them or reports the error.

Fixes: 4342306f0f ("fs/ntfs3: Add file operations and implementation")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
This commit is contained in:
Weiming Shi 2026-07-12 06:34:26 -07:00 committed by Konstantin Komarov
parent 2727ac2ba8
commit 8021840883
No known key found for this signature in database
GPG Key ID: A9B0331F832407B6
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/ntfs3/frecord.c
View File

@ -2290,7 +2290,6 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages,
u64 vbo_disk;
size_t unc_size = 0;
u32 frame_size, i, ondisk_size;
struct page *pg;
struct ATTRIB *attr;
CLST frame, clst_data;
@ -2522,11 +2521,10 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages,
#endif
vunmap(frame_mem);
out:
for (i = 0; i < pages_per_frame; i++) {
pg = pages[i];
if (err)
clear_highpage(pg);
SetPageUptodate(pg);
if (!err) {
for (i = 0; i < pages_per_frame; i++) {
SetPageUptodate(pages[i]);
}
}
return err;