Re: [PATCH 2/2] ntfs: do not use a stale runlist pointer when undoing $MFT extension

[liubaolin <liubaolin12138@163.com>]

在 2026/9/27 18:57, Matthias Goergens 写道:
> When ntfs_mft_data_extend_allocation_nolock() fails after it has
> rebuilt the mapping pairs of the last $MFT data extent, undo_alloc
> truncates the runlist and then rebuilds the old mapping pairs from rl2,
> a pointer into the runlist taken before the truncation.
> ntfs_rl_truncate_nolock() can reallocate the runlist, and KASAN then
> reports a use-after-free in ntfs_mapping_pairs_build().
> 
> Pass the start of the runlist instead, and hold the runlist lock for
> reading while the mapping pairs are built from it.
> ntfs_mapping_pairs_build() skips to the element containing the first
> vcn by itself.
> 
> Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
> Cc: stable@vger.kernel.org
> Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
> ---
> A forced lookup failure of the first $MFT data extent, on a volume
> whose $MFT has several extents, gives the KASAN report before this
> patch and nothing after it.
> 
>   fs/ntfs/mft.c | 9 +++++++--
>   1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
> index 58676042444b6..5831ea7600315 100644
> --- a/fs/ntfs/mft.c
> +++ b/fs/ntfs/mft.c
> @@ -2081,11 +2081,16 @@ static int ntfs_mft_data_extend_allocation_nolock(struct ntfs_volume *vol)
>   	if (ctx) {
>   		a = ctx->attr;
>   		if (mp_rebuilt && !IS_ERR(ctx->mrec)) {
> -			if (ntfs_mapping_pairs_build(vol, (u8 *)a + le16_to_cpu(
> +			int err;
> +
> +			down_read(&mft_ni->runlist.lock);
> +			err = ntfs_mapping_pairs_build(vol, (u8 *)a + le16_to_cpu(
>   				a->data.non_resident.mapping_pairs_offset),
>   				old_alen - le16_to_cpu(
>   					a->data.non_resident.mapping_pairs_offset),
> -				rl2, ll, -1, NULL, NULL, NULL)) {
> +				mft_ni->runlist.rl, ll, -1, NULL, NULL, NULL);
> +			up_read(&mft_ni->runlist.lock);
> +			if (err) {
>   				ntfs_error(vol->sb, "Failed to restore mapping pairs array.%s", es);
>   				NVolSetErrors(vol);
>   			}


Looks good to me.

Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>