Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

When a compressed or sparse attribute has its clusters frame-aligned,
vcn is rounded down to the frame start using cmask, which can result
in vcn != vcn0. In this case, vcn and vcn0 may reside in different
attribute segments.

The code already handles the case where vcn is in a different segment
by loading its runs before allocation. However, it fails to load runs
for vcn0 when vcn0 resides in a different segment than vcn. This causes
run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was
never loaded into the in-memory run list, triggering the WARN_ON(1).

Fix this by adding a missing check for vcn0 after the existing vcn
segment check. If vcn0 falls outside the current segment range
[svcn, evcn1), find and load the attribute segment containing vcn0
before performing the run lookup.

The following scenario triggers the bug:
attr_data_get_block_locked()
vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment
load runs for vcn segment <- vcn0 segment not loaded!
attr_allocate_clusters() <- allocation succeeds
run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN
WARN_ON(1) <- bug fires here!

Reported-by: syzbot+c1e9aedbd913fadad617@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c1e9aedbd913fadad617
Fixes: c380b52f6c57 ("fs/ntfs3: Change new sparse cluster processing")
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

authored by

Deepanshu Kartikey and committed by
Konstantin Komarov
d7ea8495 81ad9e67

+15
+15
fs/ntfs3/attrib.c
··· 1152 1152 if (err) 1153 1153 goto out; 1154 1154 } 1155 + 1156 + if (vcn0 < svcn || evcn1 <= vcn0) { 1157 + struct ATTRIB *attr2; 1158 + 1159 + attr2 = ni_find_attr(ni, attr_b, &le_b, ATTR_DATA, NULL, 1160 + 0, &vcn0, &mi); 1161 + if (!attr2) { 1162 + err = -EINVAL; 1163 + goto out; 1164 + } 1165 + err = attr_load_runs(attr2, ni, run, NULL); 1166 + if (err) 1167 + goto out; 1168 + } 1169 + 1155 1170 da = false; /* no delalloc for compressed file. */ 1156 1171 } 1157 1172