[SRU][R][PATCH v2 0/1] ntfs3: use page allocation for resident attribute inline data (LP: #2165844)

[Viktor Pashaiev]

BugLink: https://bugs.launchpad.net/bugs/2165844

SRU Justification:

[ Impact ]

Any buffered write() to an ntfs3-mounted volume can trigger a kernel BUG in
the generic iomap write path and panic the kernel:
  kernel BUG at fs/iomap/buffered-io.c:1061!
  RIP: 0010:iomap_write_end+0x...

This crash is reachable from unprivileged userspace with a plain write(2)
syscall (e.g. file copy, rsync, or appending data). Small files with resident
attribute data allocate inline_data using kmemdup() from slab. Because slab
allocations rarely start at the beginning of a physical page (i.e.
offset_in_page(inline_data) > 0), when the file size plus that offset exceeds
PAGE_SIZE (4096 bytes), iomap_inline_data_valid() fails and hits the BUG_ON
assertion, immediately crashing the system.

[ Fix ]

Backport upstream commit 36ee1313199b7f16bf963c6ac0241861585125d9:
"fs/ntfs3: Use page allocation for resident attribute inline data".

Replace kmemdup() with alloc_page(GFP_NOFS | __GFP_ZERO) so that
page_address() is always strictly page-aligned (offset_in_page == 0).
Update the cleanup path to put_page() accordingly.
For Ubuntu 7.0 (resolute), paths are adjusted from fs/ntfs/ (upstream 7.1+)
to fs/ntfs3/ (Ubuntu 7.0 kernel driver location).

[ Test Plan ]

1. Create and mount an NTFS filesystem:
   mkfs.ntfs -Q -F /dev/loopX
   mount -t ntfs3 /dev/loopX /mnt
2. Perform buffered writes on small resident files near the 4KB boundary
   from an unprivileged account.
   Without the fix: triggers immediate kernel BUG_ON at fs/iomap/buffered-io.c:1061.
   With the fix: write completes successfully without panic, and data integrity
   is verified upon unmount/remount.

[ Where problems could occur ]

The change is strictly isolated to resident attribute handling in fs/ntfs3.
Instead of allocating arbitrary slab chunks, a single dedicated page is
allocated and immediately released via put_page() upon completion of the
iomap operation. The memory overhead is negligible (4KB transient per active
resident write), and non-resident attributes or other filesystems are
completely unaffected.

[ Other Info ]

This fix was requested by Benjamin Wheeler in LP: #2165844.
The backport was verified with independent clean builds on linux-source-7.0.0
against both 7.0.0-31-generic and 7.0.0-30-generic headers, and git am
applies cleanly without offsets or warnings.

Changes in v2:
- Include all five required SRU sections ([ Impact ], [ Fix ], [ Test Plan ],
  [ Where problems could occur ], [ Other Info ]) with canonical bracket spacing.
- Embed full SRU justification into the commit message of patch 1/1 as well.

Namjae Jeon (1):
  ntfs3: use page allocation for resident attribute inline data

 fs/ntfs3/attrib.c | 10 +++++++---
 fs/ntfs3/inode.c  |  7 ++++---
 2 files changed, 11 insertions(+), 6 deletions(-)

-- 
2.43.0