linux-kernel - Forwarded: Re: [syzbot] [ntfs3?] WARNING in ni

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6909a194.050a0220.98a6.00a0.GAE@google.com>
Date: Mon, 03 Nov 2025 22:47:48 -0800
From: syzbot <syzbot+4d8e30dbafb5c1260479@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: Re: [syzbot] [ntfs3?] WARNING in ni_rename (2)

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: Re: [syzbot] [ntfs3?] WARNING in ni_rename (2)
Author: listout@...tout.xyz

On 30.10.2025 15:35, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    e53642b87a4f Merge tag 'v6.18-rc3-smb-server-fixes' of git..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15ca5932580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=41ad820f608cb833
> dashboard link: https://syzkaller.appspot.com/bug?extid=4d8e30dbafb5c1260479
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17273fe2580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15374fe2580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/c69a7713b158/disk-e53642b8.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/7138dd74fe48/vmlinux-e53642b8.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/e715eea6ae3e/bzImage-e53642b8.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/cd997f980581/mount_0.gz
> 
> The issue was bisected to:
> 
> commit d2d6422f8bd17c6bb205133e290625a564194496
> Author: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
> Date:   Fri Sep 6 10:59:04 2024 +0000
> 
>     x86: Allow to enable PREEMPT_RT.
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16e84e14580000
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=15e84e14580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=11e84e14580000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+4d8e30dbafb5c1260479@...kaller.appspotmail.com
> Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")

#syz test

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 8f9fe1d7a690..d9cca094960b 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -3023,6 +3023,18 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni,
 	/*
 	 * Way 1 - Add new + remove old.
 	 */
+	struct inode *dir_inode = &dir_ni->vfs_inode;
+	struct inode *new_dir_inode = &new_dir_ni->vfs_inode;
+
+	if (dir_inode == new_dir_inode) {
+		inode_lock(dir_inode);
+	} else if (dir_inode < new_dir_inode) {
+		inode_lock(dir_inode);
+		inode_lock(new_dir_inode);
+	} else {
+		inode_lock(new_dir_inode);
+		inode_lock(dir_inode);
+	}
 	err = ni_add_name(new_dir_ni, ni, new_de);
 	if (!err) {
 		err = ni_remove_name(dir_ni, ni, de, &de2, &undo);
@@ -3042,6 +3054,13 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni,
 	 *	}
 	 */
 
+	if (dir_inode == new_dir_inode) {
+		inode_unlock(dir_inode);
+	} else {
+		inode_unlock(dir_inode);
+		inode_unlock(new_dir_inode);
+	}
+
 	return err;
 }
 

-- 
Regards,
listout