Forwarded: Re: [syzbot] [ntfs3?] WARNING in ni_rename (2)

[syzbot <syzbot+4d8e30dbafb5c1260479@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [ntfs3?] WARNING in ni_rename (2)
Author: listout@listout.xyz

On 30.10.2025 15:35, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    e53642b87a4f Merge tag 'v6.18-rc3-smb-server-fixes' of git..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15ca5932580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=41ad820f608cb833
> dashboard link: https://syzkaller.appspot.com/bug?extid=4d8e30dbafb5c1260479
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17273fe2580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15374fe2580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/c69a7713b158/disk-e53642b8.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/7138dd74fe48/vmlinux-e53642b8.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/e715eea6ae3e/bzImage-e53642b8.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/cd997f980581/mount_0.gz
> 
> The issue was bisected to:
> 
> commit d2d6422f8bd17c6bb205133e290625a564194496
> Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> Date:   Fri Sep 6 10:59:04 2024 +0000
> 
>     x86: Allow to enable PREEMPT_RT.
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=16e84e14580000
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=15e84e14580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=11e84e14580000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+4d8e30dbafb5c1260479@syzkaller.appspotmail.com
> Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")

#syz test

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 8f9fe1d7a690..d9cca094960b 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -3023,6 +3023,18 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni,
 	/*
 	 * Way 1 - Add new + remove old.
 	 */
+	struct inode *dir_inode = &dir_ni->vfs_inode;
+	struct inode *new_dir_inode = &new_dir_ni->vfs_inode;
+
+	if (dir_inode == new_dir_inode) {
+		inode_lock(dir_inode);
+	} else if (dir_inode < new_dir_inode) {
+		inode_lock(dir_inode);
+		inode_lock(new_dir_inode);
+	} else {
+		inode_lock(new_dir_inode);
+		inode_lock(dir_inode);
+	}
 	err = ni_add_name(new_dir_ni, ni, new_de);
 	if (!err) {
 		err = ni_remove_name(dir_ni, ni, de, &de2, &undo);
@@ -3042,6 +3054,13 @@ int ni_rename(struct ntfs_inode *dir_ni, struct ntfs_inode *new_dir_ni,
 	 *	}
 	 */
 
+	if (dir_inode == new_dir_inode) {
+		inode_unlock(dir_inode);
+	} else {
+		inode_unlock(dir_inode);
+		inode_unlock(new_dir_inode);
+	}
+
 	return err;
 }
 

-- 
Regards,
listout