Re: [BUG/RFC] ntfs: crafted image triggers WARN_ON in ntfs_map_runlist_nolock()

[이상호]

From: Sangho Lee <kudo3228@xxxxxxxxx>

Hi Namjae,

Thanks for the patch.

I applied it to my NTFS test tree and rebuilt the kernel. I then reran
syz-repro with the same syzkaller crash log that reproduced the original
WARN_ON in ntfs_map_runlist_nolock() on the unpatched kernel.

Result:
- unpatched kernel: the same log reproduced the WARN_ON in
  ntfs_map_runlist_nolock()
- patched kernel: syz-repro ran through all extraction phases for 29m28s
  and failed to reproduce the warning:
  - 15s single runs: no crash
  - 15s grouped/bisect: did not crash
  - 1m40s single runs: no crash
  - 1m55s grouped/bisect: did not crash
  - 6m single runs: no crash
  - 6m15s grouped/bisect: did not crash
  - no kernel WARNING/Oops/BUG lines were observed

The change also matches the root cause I saw: when ctx_needs_reset is true,
ntfs_map_runlist_nolock() can reach the runlist mapping path for a resident
attribute. Returning -EIO before using the non-resident mapping fields avoids
triggering the WARN_ON and prevents the invalid path.

So yes, this patch fixes the issue from my side.

Tested-by: Sangho Lee <kudo3228@xxxxxxxxx>

Thanks,
Sangho