kernel/linux.git/fs/ntfs, branch v7.2-rc1

Merge tag 'ntfs-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs

2026-06-19T20:23:59+00:00

Pull ntfs updates from Namjae Jeon: - Harden handling of malformed on-disk metadata. This adds stricter validation for attributes, attribute lists, index roots and entries, EA entries, mapping pairs, and $LogFile restart areas. These changes fix several out-of-bounds access, integer overflow, and inconsistent metadata handling issues. - Prevent a writeback deadlock involving extent MFT records - Fix resource leaks in fill_super() failure paths and the name cache - Serialize volume label access and improving its error handling - Fix mapping-pairs decoding bounds and LCN overflow checks - Keep resident index root metadata consistent during resize - Fix the reported size of symbolic links - Avoid an unnecessary allocation for resident inline data - Add support for following and creating Windows native symbolic links. Relative links, absolute links, and junctions are handled, with new mount options controlling native symlink creation and absolute target translation. The existing WSL symlink behavior remains the default. - The unsupported quota code is removed, along with several smaller cleanups * tag 'ntfs-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (39 commits) docs/fs/ntfs: add mount options to support Windows native symbolic links ntfs: support creating Windows native symlinks ntfs: clean up target name conversion for WSL symlinks ntfs: add native_symlink mount option ntfs: support following Windows native symlink with absolute paths ntfs: support following Windows native symlink with relative paths ntfs: fix incorrect size of symbolic link ntfs: use direct pointer for inline data to avoid redundant allocation ntfs: validate resident index root values on lookup ntfs: update index root allocated size before shrink ntfs: grow index root value before reparent header update ntfs: reject non-resident records for resident-only attributes ntfs: fix u16 truncation of restart-area length check ntfs: bound the attribute-list entry in ntfs_read_inode_mount() ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() ntfs: validate resident attribute lists and harden the validator ntfs: validate resident volume name values on lookup ntfs: reinit search context before volume information lookup ntfs: do not replace volume name after lookup errors ntfs: validate attribute values on lookup ...

ntfs: support creating Windows native symlinks

2026-06-15T10:39:43+00:00

And introduce the symlink= mount option to configure how symbolic links are created. The option accepts "wsl" or "native", with "wsl" being the default. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: clean up target name conversion for WSL symlinks

2026-06-15T10:39:41+00:00

WSL symlink target names are stored as narrow NLS/UTF-8 strings on disk. Converting the target name to Unicode in ntfs_symlink and converting it back to NLS in ntfs_reparse_set_wsl_symlink is redundant. Remove this conversion and pass the symname directly to the reparse data setter. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: add native_symlink mount option

2026-06-15T10:39:39+00:00

Because bind-mounted subtrees of the volume may resolve to unexpected locations, change converting junctions and non-relative symbolic links into paths relative to the NTFS volume to be allowed only if the native_symlink=rel mount option is specified. Add the native_symlink= mount option to configure how absolute symbolic links and mount points (junctions) are handled. The option accepts "raw" or "rel", with "raw" being the default. Under "raw", the absolute target path (ni->target) is returned as-is without translation. Under "rel", ntfs_translate_junction() is called to rewrite the absolute path as a relative path anchored at the volume root. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: support following Windows native symlink with absolute paths

2026-06-15T10:39:37+00:00

Extend reparse-point handling beyond relative symlinks so NTFS can expose the Windows absolute forms used by non-relative symbolic links and junctions. * Store the reparse tag and symlink flags in the inode. * Validate junction payloads, and parse targets from substitute_name. * Add function to rewrite supported Windows absolute path into Linux path relative to the mounted NTFS volume. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: support following Windows native symlink with relative paths

2026-06-15T10:39:34+00:00

Make ntfs_make_symlink() parse native Windows symbolic link reparse payloads when the SYMLINK_FLAG_RELATIVE bit is set. Implement the following changes: * Add a dedicated on-disk layout definition for symbolic link reparse data. * validate the UTF-16 name ranges before decoding them. * convert the substitute name into the mount's NLS and normalize path separators. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: fix incorrect size of symbolic link

2026-06-15T10:39:31+00:00

This patch fixes the issue where a symbolic link size is displayed as 0. Cc: stable@vger.kernel.org # v7.1 Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: use direct pointer for inline data to avoid redundant allocation

2026-06-09T12:51:02+00:00

Previously, NTFS used page allocation for IOMAP_INLINE to ensure that the inline_data pointer was page-aligned, avoiding strict boundary checks in the iomap core. Since the previous patch has removed the over-strict PAGE_SIZE boundary check in iomap, NTFS can now safely point iomap::inline_data directly to the MFT record. This change eliminates redundant memory allocations and memcpy operations in both read and write paths. It also simplifies the iomap_ops by removing the need for a iomap_end callback that was previously used to free the temporary page. Reviewed-by: Christoph Hellwig Signed-off-by: Namjae Jeon

ntfs: validate resident index root values on lookup

2026-06-09T12:51:01+00:00

Resident $INDEX_ROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those checks are scattered and do not cover all root header invariants, such as entries_offset alignment and lower bound, index_length, and allocated_size consistency. The resident root resize paths now keep these header fields consistent while the value size changes: ntfs_ir_truncate() lowers index.allocated_size before shrinking the resident value, and ntfs_ir_reparent() grows the resident value before publishing a larger root header. Lookup-time validation can therefore cover these invariants without tripping over the driver's own resize paths. Add $INDEX_ROOT to the minimum resident value size table and validate the resident index header fields before returning the attribute from lookup. Require 8-byte aligned index header fields, a sane entries_offset, an index_length within allocated_size, allocated_size within the resident value, and enough entry space for at least an index entry header. The shared validator already rejects non-resident records for resident-only attribute types, including $INDEX_ROOT. Cc: stable@vger.kernel.org # v7.1 Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon

ntfs: update index root allocated size before shrink

2026-06-09T12:50:59+00:00

ntfs_ir_truncate() currently shrinks the resident $INDEX_ROOT value first and only updates index.allocated_size after re-looking up the attribute. During that relookup, the resident value_length can already be smaller while index.allocated_size still contains the old larger size. That leaves a transiently inconsistent $INDEX_ROOT layout and prevents lookup-time $INDEX_ROOT validation from being enabled: validation can correctly reject allocated_size extending past the newly shrunk resident value. When shrinking, lower index.allocated_size before shrinking value_length. If the truncate fails, restore the old allocated_size. Keep the existing grow ordering because the old allocated_size remains within the enlarged resident value until it is updated after the relookup. The shrink path is safe because the new value_length still covers struct index_root, so the index.allocated_size field remains present while it is updated first. Cc: stable@vger.kernel.org # v7.1 Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon