Re: [BUG/RFC] ntfs: crafted image triggers WARN_ON in ntfs_map_runlist_nolock()

[Namjae Jeon]

On Fri, Jul 3, 2026 at 12:39 PM 이상호 <kudo3228@xxxxxxxxx> wrote:
>
> From: Sangho Lee <kudo3228@xxxxxxxxx>
>
> Hi Namjae,
>
> Thanks for the patch.
>
> I applied it to my NTFS test tree and rebuilt the kernel. I then reran
> syz-repro with the same syzkaller crash log that reproduced the original
> WARN_ON in ntfs_map_runlist_nolock() on the unpatched kernel.
>
> Result:
> - unpatched kernel: the same log reproduced the WARN_ON in
>   ntfs_map_runlist_nolock()
> - patched kernel: syz-repro ran through all extraction phases for 29m28s
>   and failed to reproduce the warning:
>   - 15s single runs: no crash
>   - 15s grouped/bisect: did not crash
>   - 1m40s single runs: no crash
>   - 1m55s grouped/bisect: did not crash
>   - 6m single runs: no crash
>   - 6m15s grouped/bisect: did not crash
>   - no kernel WARNING/Oops/BUG lines were observed
>
> The change also matches the root cause I saw: when ctx_needs_reset is true,
> ntfs_map_runlist_nolock() can reach the runlist mapping path for a resident
> attribute. Returning -EIO before using the non-resident mapping fields avoids
> triggering the WARN_ON and prevents the invalid path.
>
> So yes, this patch fixes the issue from my side.
>
> Tested-by: Sangho Lee <kudo3228@xxxxxxxxx>
I will add your tested-by tag to the patch.
Thanks for the test!