[PATCH 6.1.y v2 0/4] fs/ntfs3: backport slab-out-of-bounds fix (CVE-2026-90048)

[Nikita Nagornyi]

This series backports the fix for a slab-out-of-bounds write in the ntfs3
driver (CVE-2026-90048, an Important / CVSS 7.8 issue) to 6.1.y, together
with its stable dependency chain.

Applied in order:

  a8f659ce14f8 ("fs/ntfs3: Add more checks in mi_enum_attr (part 2)")
      - dependency
  2afd4d267e6d ("fs/ntfs3: Mark inode as bad as soon as error detected in
      mi_enum_attr()")
      - dependency; introduces the struct ntfs_inode *ni parameter threaded
        through mi_enum_attr()/mi_find_attr()/mi_insert_attr()/mi_new_attt_id()
  5f33da04e6ce ("fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list")
      - dependency
  7c4841e2a627 ("fs/ntfs3: fix slab-out-of-bounds write in
      ni_create_attr_list()")
      - the fix

Patches 2/4 and 3/4 needed adaptation for 6.1.y and carry a
"[ Backport to 6.1.y: ... ]" note describing the changes.

Built and boot-tested on x86_64 and aarch64. Tested on Amazon EC2 using our
internal test suite, including xfstests, kselftest, LTP; passed with no regressions.

Changes in v2:
- 1/4: add the missing "[ Upstream commit a8f659ce14f8f734894227ba2c5ca78c8451501e ]"
  tag (Sasha)
- 4/4: return -EINVAL directly when lsize == 0, as upstream does; on 6.1.y
  the out: label in ni_create_attr_list() returns 0 because 14f527d44de6
  ("fs/ntfs3: Correct checking while generating attr_list") isn't in 6.1.y,
  so the v1 "err = -EINVAL; goto out" reported success (Sasha). With that,
  4/4 matches upstream and the backport note was dropped.

v1: https://lore.kernel.org/stable/20261001114549.162469-1-nagornyi@xxxxxxxxx/

HE WEI（ギカク） (1):
  fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

Konstantin Komarov (2):
  fs/ntfs3: Add more checks in mi_enum_attr (part 2)
  fs/ntfs3: Mark inode as bad as soon as error detected in
    mi_enum_attr()

Nirbhay Sharma (1):
  fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list

 fs/ntfs3/attrib.c  | 11 +++---
 fs/ntfs3/frecord.c | 79 ++++++++++++++++++++++++----------------
 fs/ntfs3/ntfs_fs.h | 21 ++++++-----
 fs/ntfs3/record.c  | 91 +++++++++++++++++++++++++++-------------------
 4 files changed, 117 insertions(+), 85 deletions(-)


base-commit: a500ba24937a966eab140b95eac42782a7ce2c85
-- 
2.50.1