[PATCH v2] fs/ntfs3: fix double ni_unlock() in ntfs_readdir()

[PATCH v2] fs/ntfs3: fix double ni_unlock() in ntfs_readdir()

[Christian Aurich Zanettini Martins]

ntfs_readdir() drops ni_lock before each ntfs_read_hdr() call and jumps
to out if the call returns non-zero. As posted, the patch that became
commit 7a5aa6c45072 ("ntfs3: release ni_lock before dir_emit in
ntfs_readdir to fix deadlocks") used out as the label after ni_unlock().
It was applied on top of commit fb058ccff579 ("fs/ntfs3: take ni_lock()
once in ntfs_readdir()"), which renamed out_unlock to out, so these
jumps now unlock a lock that is no longer held.

This also happens when getdents64() fills the supplied buffer,
triggering a lockdep "bad unlock balance" warning.

Jump to out_free instead to avoid unlocking an already released lock.

Reported-by: syzbot+5c0ed4f2974a8b100ed4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5c0ed4f2974a8b100ed4
Fixes: 7a5aa6c45072 ("ntfs3: release ni_lock before dir_emit in ntfs_readdir to fix deadlocks")
Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
---

Notes:
    Changes in v2:
    - Explain that the bug comes from 7a5aa6c45072 being applied on top
      of fb058ccff579 (Yun Zhou). No code change.
    - Rebase on ntfs3 master (da4391c496fe is now 7a5aa6c45072).
    - v1: https://lore.kernel.org/all/20261023223533.686085-1-christian.aurichzm@gmail.com/
    
    Based on Paragon's ntfs3 master (ee1cb3443cff), also in next-20261028.
    
    Tested in QEMU with lockdep. A 128-byte getdents64() buffer
    reproduced the warning before the fix. After the fix, no warning
    occurred when reading root-only and 700-entry directories,
    including four concurrent readers and a writer.

 fs/ntfs3/dir.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index b54828735d55..45d6a41a7222 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -563,7 +563,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
 		 */
 		err = ntfs_read_hdr(sbi, ni, &root->ihdr, 0, pos, name, ctx);
 		if (err)
-			goto out;
+			goto out_free;
 
 		ni_lock(ni);
 		bit = 0;
@@ -607,7 +607,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
 				    ((u64)bit << index_bits) + sbi->record_size,
 				    pos, name, ctx);
 		if (err)
-			goto out;
+			goto out_free;
 
 		ni_lock(ni);
 	}
@@ -615,6 +615,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
 out:
 	ni_unlock(ni);
 
+out_free:
 	kfree(name);
 	put_indx_node(node);
 

base-commit: ee1cb3443cff5a800948b662756f75b17ca63fe2
-- 
2.43.0

Re: [PATCH v2] fs/ntfs3: fix double ni_unlock() in ntfs_readdir()

[Christian Aurich Zanettini Martins]

Hi Konstantin,

Any update on this? The bug is in 7.4-rc1 now and syzbot is still
hitting it. v2 still applies.