Re: [PATCH 1/2] ntfs: don't write a compression block after a short copy

[Hyunchul Lee <hyc.lee@gmail.com>]

Hi Zhan,

On Thu, Nov 05, 2026 at 09:01:58PM +0800, Zhan Xusheng wrote:
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> 
> ntfs_compress_write() does not read in the folios of a compression
> block that the write covers completely. If the copy from user space
> then comes up short, the rest of those folios still holds whatever
> the memory held before; ntfs_write_cb() compresses that to disk and
> the folios are marked uptodate.
> 
> The copy can come up short after fault_in_iov_iter_readable() has
> succeeded if the source buffer is unmapped in between. On a volume
> with 4K clusters, writing 64K at offset 0 of a compressed file while
> another thread unmaps and remaps the last page of the buffer leaves
> 61440 new bytes followed by 4096 bytes of another process's freed
> memory in the file. The write returns -EFAULT.
> 
> Treat a short copy into a full block like a copy that made no
> progress.
> 
> Fixes: 5b676a77f3e4 ("ntfs: skip reads for full compression unit overwrites")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>

This patch looks good to me. But the second patch in this series
appears to be missing.

Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>

> ---
> Tested in QEMU on ntfs-next with KASAN, 4K clusters, page cache
> dropped and freed memory filled with 'Z' before each write:
> 
>   before: 16 of 41 writes failed, 3 of them changed the file, each
>           time bytes 61440-65535 read back as 0x5a
>   after:  286 of 731 writes failed, none changed the file
> 
> The same loop on rootfs gives short writes and no corruption. I can
> send the reproducer if it helps.
> 
>  fs/ntfs/compress.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/fs/ntfs/compress.c b/fs/ntfs/compress.c
> index 82c7c7d29073..287bd47282d9 100644
> --- a/fs/ntfs/compress.c
> +++ b/fs/ntfs/compress.c
> @@ -1567,6 +1567,16 @@ int ntfs_compress_write(struct ntfs_inode *ni, loff_t pos, size_t count,
>  			}
>  		}
>  
> +		/*
> +		 * The folios of a full compression block are not read in, so
> +		 * after a short copy the rest of the block holds whatever the
> +		 * folios contained.  Don't write that out.
> +		 */
> +		if (full_cb && copied < cb_size) {
> +			iov_iter_revert(from, copied);
> +			copied = 0;
> +		}
> +
>  		if (!copied) {
>  			err = -EFAULT;
>  			goto release_pages;
> 
> base-commit: 564c7753647731d19170914c1c637d3b33d88d3b
> -- 
> 2.43.0
> 

-- 
Thanks,
Hyunchul