Re: [PATCH v3] ntfs: fix race between fallocate and mmap reads

[Namjae Jeon]

On Thu, Aug 27, 2026 at 2:59 PM Hongling Zeng <zenghongling@xxxxxxxxxx> wrote:
>
> The fallocate implementation only takes invalidate_lock for punch hole,
> collapse range, and insert range operations. For standard allocation modes
> (mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.
>
> During ntfs_attr_fallocate(), new clusters are mapped to the runlist via
> ntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This
> creates a window where concurrent mmap page faults can read uninitialized
> disk data.
>
> Since mmap uses filemap_fault() which takes invalidate_lock in shared mode,
> it can fault in pages during this window and expose old disk contents to
> userspace. This is an information leak and data integrity issue.
>
> Fix by taking invalidate_lock for all fallocate operations, not just for
> punch/collapse/insert modes. This prevents concurrent page faults from
> accessing unzeroed clusters during the allocation window.
>
> Fixes: 495e90fa3348 ("ntfs: update attrib operations")
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Baolin Liu <liubaolin@xxxxxxxxxx>
> Reviewed-by: Hyunchul Lee <hyc.lee@xxxxxxxxx>
> Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
Applied it to #ntfs-next.
Thanks!