[PATCH] fs/ntfs3: fix cluster over-free on allocation failure

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>

ntfs_look_for_free_space() returns in @flen how many clusters it marked
used, which is fewer than the requested @len whenever wnd_find() falls
back to the longest free run it could find.  That run is maximal, so the
cluster just past it is in use.  The undo path after a failed
run_add_entry() frees @len, releasing clusters that are still referenced,
and a later allocation can hand them out again.

run_add_entry() fails only when its kvmalloc() does.

Commit 0e5b044cbf3a ("fs/ntfs3: Refactoring attr_set_size to restore
after errors") replaced wnd_set_free(wnd, lcn, flen) here with
mark_as_free_ex(sbi, lcn, len, false).  Use @flen again.

Fixes: 0e5b044cbf3a ("fs/ntfs3: Refactoring attr_set_size to restore after errors")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
---
 fs/ntfs3/attrib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index b1c315206ffa..fefd201809a5 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -199,7 +199,7 @@ int attr_allocate_clusters(struct ntfs_sb_info *sbi, struct runs_tree *run,
 		if (!run_add_entry(run, vcn, lcn, flen, opt & ALLOCATE_MFT)) {
 undo_alloc:
 			/* Undo last 'ntfs_look_for_free_space' */
-			mark_as_free_ex(sbi, lcn, len, false);
+			mark_as_free_ex(sbi, lcn, flen, false);
 			err = -ENOMEM;
 			goto out;
 		}

base-commit: 3ac032ef6ca8e47bb06d1e189dfcf88fa0a09c75
-- 
2.43.0