From 80218408836fa6fc91a9c26a9c014f81abf9e41f Mon Sep 17 00:00:00 2001 From: Weiming Shi Date: Sun, 12 Jul 2026 06:34:26 -0700 Subject: [PATCH] fs/ntfs3: do not mark frame pages uptodate on read error ni_read_frame() ends with a loop that marks every page of a compressed frame uptodate regardless of whether the read succeeded: out: for (i = 0; i < pages_per_frame; i++) { pg = pages[i]; SetPageUptodate(pg); } Non-critical frame pages come from __filemap_get_folio(FGP_CREAT) and are not zeroed. On an error path that reaches out: before frame_mem is written, these pages keep uninitialized page-allocator contents but are still marked uptodate. A later read() is then served from the page cache and returns that stale kernel memory to user space. For an unprivileged user mounting a crafted NTFS image this is a repeatable kernel memory disclosure. Mark the pages uptodate only on success; on error leave them !uptodate so the read path re-reads them or reports the error. Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Signed-off-by: Konstantin Komarov --- fs/ntfs3/frecord.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index b9831eea53d4..16ac847de48d 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -2290,7 +2290,6 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages, u64 vbo_disk; size_t unc_size = 0; u32 frame_size, i, ondisk_size; - struct page *pg; struct ATTRIB *attr; CLST frame, clst_data; @@ -2522,11 +2521,10 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages, #endif vunmap(frame_mem); out: - for (i = 0; i < pages_per_frame; i++) { - pg = pages[i]; - if (err) - clear_highpage(pg); - SetPageUptodate(pg); + if (!err) { + for (i = 0; i < pages_per_frame; i++) { + SetPageUptodate(pages[i]); + } } return err;