For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [ntfs3?] WARNING in ni_rename (2)
Author: junjie.cao@linux.dev

#syz test

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 2e901d073..c12047153 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -2776,6 +2776,8 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni,
 {
 	int err;
 	struct NTFS_DE *de2 = NULL;
+	struct ATTR_FILE_NAME *de_name = (struct ATTR_FILE_NAME *)(de + 1);
+	struct ATTR_FILE_NAME *fname;
 	int undo = 0;
 
 	/*
@@ -2789,14 +2791,30 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni,
 	 * and then can't restore (add) old name.
 	 */
 
+	/*
+	 * Pre-validate: ensure the old name attribute exists in the MFT
+	 * record.  On corrupted volumes the attribute may be missing, which
+	 * would cause ni_remove_name() to fail after ni_add_name() has
+	 * already modified the directory, leaving the inode inconsistent.
+	 */
+	mi_get_ref(&dir_ni->mi, &de_name->home);
+	fname = ni_fname_name(ni, (struct le_str *)&de_name->name_len,
+			      &de_name->home, NULL, NULL);
+	if (!fname)
+		return -ENOENT;
+
 	/*
 	 * Way 1 - Add new + remove old.
 	 */
 	err = ni_add_name(new_dir_ni, ni, new_de);
 	if (!err) {
 		err = ni_remove_name(dir_ni, ni, de, &de2, &undo);
-		WARN_ON(err &&
-			ni_remove_name(new_dir_ni, ni, new_de, &de2, &undo));
+		if (err &&
+		    ni_remove_name(new_dir_ni, ni, new_de, &de2, &undo)) {
+			ntfs_inode_warn(
+				&ni->vfs_inode,
+				"failed to undo rename, inode is inconsistent");
+		}
 	}
 
 	/*