[PATCH v2 0/2] ntfs: fix the undo path of $MFT data extension

[Matthias Goergens]

These fix two bugs in the undo path of
ntfs_mft_data_extend_allocation_nolock(): patch 1 makes its $MFT
runlist locking consistent, and patch 2 fixes a use-after-free of a
pointer into the runlist across the truncation.

Both paths only run when something fails while $MFT grows, so I tested
them in QEMU by forcing each failure once with a debug patch.  The
debug patch, the test scripts and the images are at
https://github.com/matthiasgoergens/linux/tree/reproducer/2026-09-28-ntfs-mft-extend-undo-v2

Changes in v2:
- Patch 1: if ntfs_rl_truncate_nolock() fails, keep the clusters
  allocated instead of freeing them, as the runlist may still reference
  them (Hyunchul Lee).  The truncation cannot fail at this call site
  today, but with a failure forced, v1 freed clusters that $MFT's
  runlist still mapped and later handed them to a data file.
- Patch 1: did not carry over Baolin Liu's Reviewed-by, as the patch
  changed.
- Patch 2: unchanged.

v1: https://lore.kernel.org/all/20260927105706.3111333-1-matthias.goergens@xxxxxxxxx/

Thanks,
Matthias

Matthias Goergens (2):
  ntfs: balance the $MFT runlist lock in data extension error paths
  ntfs: do not use a stale runlist pointer when undoing $MFT extension

 fs/ntfs/mft.c | 68 +++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 58 insertions(+), 10 deletions(-)


base-commit: 259abb551e2944998cad4214c201954ab1ac5c8d
-- 
2.55.0