ntfs: do not replace volume name after lookup errors

ntfs_write_volume_label() removes an existing $VOLUME_NAME attribute and
then adds the replacement. The old code only distinguished lookup success
from all other results, so any lookup error was treated like an absent
label and the add path still ran.

That is unsafe once lookup-time validation rejects corrupt $VOLUME_NAME
records with -EIO: the corrupt record would remain in place and a second
$VOLUME_NAME record could be appended next to it.

Only add the replacement after the old label was removed successfully or
after lookup returned -ENOENT. Propagate all other lookup errors, and
also stop if removing the old attribute fails.

Cc: stable@vger.kernel.org # v7.1
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 34d0040b385aefb22842ae6e84b8f9953a0c1fb2..081a2958386824b778714dabed448b1124a47a1a 100644 (file)
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -444,10 +444,15 @@ int ntfs_write_volume_label(struct ntfs_volume *vol, char *label)
                goto out;
        }
 
-       if (!ntfs_attr_lookup(AT_VOLUME_NAME, NULL, 0, 0, 0, NULL, 0,
-                            ctx))
-               ntfs_attr_record_rm(ctx);
+       ret = ntfs_attr_lookup(AT_VOLUME_NAME, NULL, 0, 0, 0, NULL, 0,
+                              ctx);
+       if (!ret)
+               ret = ntfs_attr_record_rm(ctx);
+       else if (ret == -ENOENT)
+               ret = 0;
        ntfs_attr_put_search_ctx(ctx);
+       if (ret)
+               goto out;
 
        ret = ntfs_resident_attr_record_add(vol_ni, AT_VOLUME_NAME, AT_UNNAMED, 0,
                                            (u8 *)uname, uname_len * sizeof(__le16), 0);