[BUG/RFC] ntfs: crafted image triggers WARN_ON in ntfs_map_runlist_nolock()

[이상호]

Hi,

I found a crafted NTFS image that triggers the following warning during
mount-time NTFS logfile handling:

  WARNING: fs/ntfs/attrib.c:177 at ntfs_map_runlist_nolock+0x1275/0x17b0

The observed stack is:

  ntfs_map_runlist_nolock
  ntfs_empty_logfile
  load_system_files
  ntfs_fill_super
  get_tree_bdev_flags
  vfs_get_tree
  do_new_mount
  __se_sys_mount

The warning site is:

  fs/ntfs/attrib.c:177
  WARN_ON(!ctx->attr->non_resident);

The caller path reaches this through:

  fs/ntfs/logfile.c:677
  err = ntfs_map_runlist_nolock(log_ni, vcn, NULL);

The current hypothesis is that a malformed image reaches the $LogFile cleanup
path and causes ntfs_map_runlist_nolock() to find a resident attribute where it
expects a non-resident one. Since the input is a crafted filesystem image, this
looks like it should be rejected through an ordinary mount error path rather
than tripping a kernel WARN_ON().

The crash was found with syzkaller/SyzDirect on a recent local mainline build.
syz-repro reproduced the warning during minimization and reduced the syscall
sequence to syz_mount_image$ntfs. I also extracted the crashing program from
the syzkaller log and generated a standalone C reproducer from it. The generated
C reproducer compiles locally.

I have not yet confirmed whether this has impact beyond a mount-time warning
from a crafted NTFS image. I can provide the full syzkaller/C reproducer and
kernel config if useful.

Thanks,
이상호