[v3] ntfs3: Allocate iomap inline_data using alloc_page

[PATCH v3] ntfs3: Allocate iomap inline_data using alloc_page

Posted by Mihai Brodschi 2 weeks, 4 days ago

This fixes a BUG reported in iomap_write_end_inline:
iomap_inline_data_valid checks that the inline_data fits within
a page. If the inline_data is allocated with kmemdup there's no
guarantee that it's page-aligned, so the check sometimes fails.
Allocate it with alloc_page to ensure it's page-aligned.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221446
Signed-off-by: Mihai Brodschi <m.brodschi@gmail.com>
Fixes: 099ef9a ("fs/ntfs3: implement iomap-based file operations")
---
V3: fix variable declaration
V2: fix mail formatting

 fs/ntfs3/attrib.c | 10 +++++++---
 fs/ntfs3/inode.c  |  4 ++--
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index e61c5bf7e27e..ff0bf4575948 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -1004,6 +1004,7 @@ int attr_data_get_block_locked(struct ntfs_inode *ni, CLST vcn, CLST clen,
 	struct ATTRIB *attr, *attr_b;
 	struct ATTR_LIST_ENTRY *le, *le_b;
 	struct mft_inode *mi, *mi_b;
+	struct page *page;
 	CLST hint, svcn, to_alloc, evcn1, next_svcn, asize, end, vcn0;
 	CLST alloc, evcn;
 	unsigned fr;
@@ -1042,10 +1043,13 @@ int attr_data_get_block_locked(struct ntfs_inode *ni, CLST vcn, CLST clen,
 		*lcn = RESIDENT_LCN;
 		*len = data_size;
 		if (res && data_size) {
-			*res = kmemdup(resident_data(attr_b), data_size,
-				       GFP_KERNEL);
-			if (!*res)
+			page = alloc_page(GFP_KERNEL);
+			if (!page) {
 				err = -ENOMEM;
+			} else {
+				*res = page_address(page);
+				memcpy(*res, resident_data(attr_b), data_size);
+			}
 		}
 		goto out;
 	}
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 42af1abe17f8..031f85fd53d4 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -801,7 +801,7 @@ static int ntfs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
 
 	if (lcn == RESIDENT_LCN) {
 		if (offset >= clen) {
-			kfree(res);
+			__free_page(virt_to_page(res));
 			if (flags & IOMAP_REPORT) {
 				/* special code for report. */
 				return -ENOENT;
@@ -921,7 +921,7 @@ static int ntfs_iomap_end(struct inode *inode, loff_t pos, loff_t length,
 
 out:
 	if (iomap->type == IOMAP_INLINE) {
-		kfree(iomap->private);
+		__free_page(virt_to_page(iomap->private));
 		iomap->private = NULL;
 	}
 
-- 
2.53.0

Re: [PATCH v3] ntfs3: Allocate iomap inline_data using alloc_page

Posted by Konstantin Komarov 1 day, 18 hours ago

On 5/11/26 19:19, Mihai Brodschi wrote:

> [You don't often get email from m.brodschi@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> This fixes a BUG reported in iomap_write_end_inline:
> iomap_inline_data_valid checks that the inline_data fits within
> a page. If the inline_data is allocated with kmemdup there's no
> guarantee that it's page-aligned, so the check sometimes fails.
> Allocate it with alloc_page to ensure it's page-aligned.
>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221446
> Signed-off-by: Mihai Brodschi <m.brodschi@gmail.com>
> Fixes: 099ef9a ("fs/ntfs3: implement iomap-based file operations")
> ---
> V3: fix variable declaration
> V2: fix mail formatting
>
>   fs/ntfs3/attrib.c | 10 +++++++---
>   fs/ntfs3/inode.c  |  4 ++--
>   2 files changed, 9 insertions(+), 5 deletions(-)
>
> diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
> index e61c5bf7e27e..ff0bf4575948 100644
> --- a/fs/ntfs3/attrib.c
> +++ b/fs/ntfs3/attrib.c
> @@ -1004,6 +1004,7 @@ int attr_data_get_block_locked(struct ntfs_inode *ni, CLST vcn, CLST clen,
>          struct ATTRIB *attr, *attr_b;
>          struct ATTR_LIST_ENTRY *le, *le_b;
>          struct mft_inode *mi, *mi_b;
> +       struct page *page;
>          CLST hint, svcn, to_alloc, evcn1, next_svcn, asize, end, vcn0;
>          CLST alloc, evcn;
>          unsigned fr;
> @@ -1042,10 +1043,13 @@ int attr_data_get_block_locked(struct ntfs_inode *ni, CLST vcn, CLST clen,
>                  *lcn = RESIDENT_LCN;
>                  *len = data_size;
>                  if (res && data_size) {
> -                       *res = kmemdup(resident_data(attr_b), data_size,
> -                                      GFP_KERNEL);
> -                       if (!*res)
> +                       page = alloc_page(GFP_KERNEL);
> +                       if (!page) {
>                                  err = -ENOMEM;
> +                       } else {
> +                               *res = page_address(page);
> +                               memcpy(*res, resident_data(attr_b), data_size);
> +                       }
>                  }
>                  goto out;
>          }
> diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
> index 42af1abe17f8..031f85fd53d4 100644
> --- a/fs/ntfs3/inode.c
> +++ b/fs/ntfs3/inode.c
> @@ -801,7 +801,7 @@ static int ntfs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
>
>          if (lcn == RESIDENT_LCN) {
>                  if (offset >= clen) {
> -                       kfree(res);
> +                       __free_page(virt_to_page(res));
>                          if (flags & IOMAP_REPORT) {
>                                  /* special code for report. */
>                                  return -ENOENT;
> @@ -921,7 +921,7 @@ static int ntfs_iomap_end(struct inode *inode, loff_t pos, loff_t length,
>
>   out:
>          if (iomap->type == IOMAP_INLINE) {
> -               kfree(iomap->private);
> +               __free_page(virt_to_page(iomap->private));
>                  iomap->private = NULL;
>          }
>
> --
> 2.53.0
>
Hello,

Your patch was applied, thank you.

Regards,
Konstantin