Re: [PATCH] fs/ntfs3: return -ERANGE for short xattr buffers
From: liubaolin
Date: Thu Jul 09 2026 - 03:28:35 EST
Dear maintainer,
I found an issue where `ntfs3` returns the wrong errno when reading `system.ntfs_attrib` with a buffer that is too small.
When the user buffer is too small, `ntfs3` currently returns `-ENODATA`.
However, `system.ntfs_attrib` does exist in this case, and the failure is only caused by the user buffer being too small.
A more appropriate return value here is `-ERANGE`, not `-ENODATA`, which normally indicates that the xattr does not exist.
To reproduce this issue, I wrote a simple test program, `ntfs3_xattr_smallbuf.c`.
First, build the test program:
gcc -O2 -Wall -o ntfs3_xattr_smallbuf ntfs3_xattr_smallbuf.c
Then reproduce it with the following steps:
truncate -s 128M /tmp/ntfs3.img
mkntfs -F -q /tmp/ntfs3.img
mkdir -p /tmp/ntfs3-mnt
mount -o loop -t ntfs3 /tmp/ntfs3.img /tmp/ntfs3-mnt
touch /tmp/ntfs3-mnt/testfile
./ntfs3_xattr_smallbuf /tmp/ntfs3-mnt/testfile
On the unpatched kernel, I see the following result:
$ ./ntfs3_xattr_smallbuf /tmp/ntfs3-mnt/testfile
getxattr failed: errno=61 (No data available)
`system.ntfs_attrib` does exist, but when the buffer is too small it returns `ENODATA`.
With this patch applied, the same test gives:
$ ./ntfs3_xattr_smallbuf /tmp/ntfs3-mnt/testfile
getxattr failed: errno=34 (Numerical result out of range)
In this case, it returns `ERANGE`.
Best regards,
Baolin
***********************************************************************************************
ntfs3_xattr_smallbuf.c:
#define _GNU_SOURCE
#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <sys/xattr.h>
int main(int argc, char *argv[])
{
const char *path = argc > 1 ? argv[1] : "/tmp/ntfs3-mnt/testfile";
char buf[1];
ssize_t ret;
ret = getxattr(path, "system.ntfs_attrib", buf, sizeof(buf));
if (ret < 0) {
printf("getxattr failed: errno=%d (%s)\n", errno, strerror(errno));
return 1;
}
printf("getxattr succeeded: ret=%zd\n", ret);
return 0;
}
**********************************************************************************************
在 2026/7/9 15:18, Baolin Liu 写道:
From: Baolin Liu <liubaolin@xxxxxxxxxx>
ntfs3 currently returns -ENODATA when the xattr exists
but the user buffer is too small.
Return -ERANGE instead.
Signed-off-by: Baolin Liu <liubaolin@xxxxxxxxxx>
---
fs/ntfs3/xattr.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index 9743a63a152e..0a19668e970d 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -781,7 +781,7 @@ static int ntfs_getxattr(const struct xattr_handler *handler, struct dentry *de,
if (!buffer) {
err = sizeof(u8);
} else if (size < sizeof(u8)) {
- err = -ENODATA;
+ err = -ERANGE;
} else {
err = sizeof(u8);
*(u8 *)buffer = le32_to_cpu(ni->std_fa);
@@ -795,7 +795,7 @@ static int ntfs_getxattr(const struct xattr_handler *handler, struct dentry *de,
if (!buffer) {
err = sizeof(u32);
} else if (size < sizeof(u32)) {
- err = -ENODATA;
+ err = -ERANGE;
} else {
err = sizeof(u32);
*(u32 *)buffer = le32_to_cpu(ni->std_fa);
@@ -835,7 +835,7 @@ static int ntfs_getxattr(const struct xattr_handler *handler, struct dentry *de,
if (!buffer) {
err = sd_size;
} else if (size < sd_size) {
- err = -ENODATA;
+ err = -ERANGE;
} else {
err = sd_size;
memcpy(buffer, sd, sd_size);