[PATCH] ntfs3: fix bitmap corruption in attr_allocate_clusters() error path

[Joas Antonio dos Santos via B4 Relay <devnull+joasantonio108.gmail.com@kernel.org>]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

The undo_alloc error path in attr_allocate_clusters() calls
mark_as_free_ex() with len (remaining clusters to allocate) instead
of flen (clusters actually allocated in the last iteration).

After the first loop iteration, len is decremented by flen, so on
subsequent iterations len represents only the remaining request size.
When run_add_entry() or run_remove_range() fails, the undo frees len
clusters starting at lcn, but only flen clusters at that position
were actually allocated. The excess clusters may belong to other files,
corrupting the allocation bitmap and causing silent data loss.

For example: a 100-cluster request where the first iteration allocates
60 (len becomes 40), and the second allocates 20 at a new lcn. If
run_add_entry() fails, undo frees 40 clusters at lcn when only 20 were
allocated there, marking 20 clusters of other files as free.

Fix by passing flen instead of len to mark_as_free_ex().

Found by LLM-assisted manual code review.

Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations")
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
 fs/ntfs3/attrib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index 805acc3ed..2a75ee162 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -207,7 +207,7 @@ int attr_allocate_clusters(struct ntfs_sb_info *sbi, struct runs_tree *run,
 		if (!run_add_entry(run, vcn, lcn, flen, opt & ALLOCATE_MFT)) {
 undo_alloc:
 			/* Undo last 'ntfs_look_for_free_space' */
-			mark_as_free_ex(sbi, lcn, len, false);
+			mark_as_free_ex(sbi, lcn, flen, false);
 			err = -ENOMEM;
 			goto out;
 		}

---
base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
change-id: 20261108-ntfs3-alloc-undo-fix-e64b8b0f8ea5

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>