From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB4F4335BCD; Fri, 9 Jan 2026 12:44:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767962660; cv=none; b=r4g5wRjAeAj7WpJuyU1lE896aJn7GrZlOULWSwWz3Om+OoQg4FIDWSS0Qsm8dHxE156ciFTUQXXU0h4AlE24FWouEwtUhiVVA0q0XpNBC5mOi89clVn2QiZlsSVyDjQMMavqcWRaeExg/IzpjDo2gKyNa0HOknDbSf+PC22mqN4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767962660; c=relaxed/simple; bh=j5zUEmfsYtMDPfSEWrTKnIqYVURms0fz/7KnAJAmRZU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KF/sxBKjdly/qaFpfHIcBT3gwvI/ujlh0Tvf04adBen4nvtwMTb9xbqed1eAC7UXJ3xlQSGNdh+qaAcJiq+UlzMxy7BvtllaLwkHkvgB1OAJ3Ixzwpl9HWN3M9Bp3HXt9Dw+QfnLqIG9sVoPv+ZUvqMDCOMadEONLlcou1YanOQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2QxnypuV; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2QxnypuV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79544C4CEF1; Fri, 9 Jan 2026 12:44:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1767962659; bh=j5zUEmfsYtMDPfSEWrTKnIqYVURms0fz/7KnAJAmRZU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2QxnypuVL/dCLeY6uYFKMkxGLKhGuSKYwTLd0JyH87+IHzcTS/7A1EwA08Xod0x0m Etusg75+0z1WRIE4l1P3RAxHp6xExtDO4KQFVIDzIfd0SQVKnWh+IDOY4Fe5lKc34Z avWiSTLDCt+p4GXmxHU/jPfnx9WS2iL6n3VdySk4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, "Matthew Wilcox (Oracle)" , Konstantin Komarov Subject: [PATCH 6.1 443/634] ntfs: Do not overwrite uptodate pages Date: Fri, 9 Jan 2026 12:42:01 +0100 Message-ID: <20260109112134.207999414@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260109112117.407257400@linuxfoundation.org> References: <20260109112117.407257400@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matthew Wilcox (Oracle) commit 68f6bd128e75a032432eda9d16676ed2969a1096 upstream. When reading a compressed file, we may read several pages in addition to the one requested. The current code will overwrite pages in the page cache with the data from disc which can definitely result in changes that have been made being lost. For example if we have four consecutie pages ABCD in the file compressed into a single extent, on first access, we'll bring in ABCD. Then we write to page B. Memory pressure results in the eviction of ACD. When we attempt to write to page C, we will overwrite the data in page B with the data currently on disk. I haven't investigated the decompression code to check whether it's OK to overwrite a clean page or whether it might be possible to see corrupt data. Out of an abundance of caution, decline to overwrite uptodate pages, not just dirty pages. Fixes: 4342306f0f0d (fs/ntfs3: Add file operations and implementation) Signed-off-by: Matthew Wilcox (Oracle) Cc: stable@vger.kernel.org Signed-off-by: Konstantin Komarov Signed-off-by: Greg Kroah-Hartman --- fs/ntfs3/frecord.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-) --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -2150,6 +2150,29 @@ out: return err; } +static struct page *ntfs_lock_new_page(struct address_space *mapping, + pgoff_t index, gfp_t gfp) +{ + struct folio *folio = __filemap_get_folio(mapping, index, + FGP_LOCK | FGP_ACCESSED | FGP_CREAT, gfp); + struct page *page; + + if (IS_ERR(folio)) + return ERR_CAST(folio); + + if (!folio_test_uptodate(folio)) + return folio_file_page(folio, index); + + /* Use a temporary page to avoid data corruption */ + folio_unlock(folio); + folio_put(folio); + page = alloc_page(gfp); + if (!page) + return ERR_PTR(-ENOMEM); + __SetPageLocked(page); + return page; +} + /* * ni_readpage_cmpr * @@ -2203,9 +2226,9 @@ int ni_readpage_cmpr(struct ntfs_inode * if (i == idx) continue; - pg = find_or_create_page(mapping, index, gfp_mask); - if (!pg) { - err = -ENOMEM; + pg = ntfs_lock_new_page(mapping, index, gfp_mask); + if (IS_ERR(pg)) { + err = PTR_ERR(pg); goto out1; } pages[i] = pg; @@ -2307,13 +2330,13 @@ int ni_decompress_file(struct ntfs_inode for (i = 0; i < pages_per_frame; i++, index++) { struct page *pg; - pg = find_or_create_page(mapping, index, gfp_mask); - if (!pg) { + pg = ntfs_lock_new_page(mapping, index, gfp_mask); + if (IS_ERR(pg)) { while (i--) { unlock_page(pages[i]); put_page(pages[i]); } - err = -ENOMEM; + err = PTR_ERR(pg); goto out; } pages[i] = pg;