From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794065108; b=nL4Q790x3onOx29GsiabUYP0YgF7H7zL660fEIHvNLS708UYwme80hOlX8oakQuyXr2f Hc+Kez6J9BIaUQHNi15O7qNKlAl0Qu03e+bARcjUttNexOR6xtWmtqNZ3Iwf6ibjGQ9xl 6x4K2GmbkvSDOaVNMrE4diMHyUmj8KaKvqnP2G59O1uq3IMNt/C+Cyk5wv8JVB85i42E4 NZ9zSj3Q8Lz/bWlxcs2e0Y5Mz78hGQnEE4QdV0IgKGzR8TwYAdk6Q/mYyITvFmwKoE4Qd U9kLU2GubiMZEfKdAGgGEuasbqiATeyRq9Ngy3nzzt7Wc/2YPHY6k0LPmCSMv0INxww== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794065108; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=TjbYnNqNsoljep+RU99gw5UHeD9VOT9D04uLMaORjeg=; b=reHb5Lolzm339sMRZKiqkSwD5E5qYvZ/TljNpbi5l3V+qGKqZF7I1mCZzR/71hVGMH3u hzHFm9LlVGJ1mdK0Ga1gZZ+cZMzKyct3VRKYsHYKm1IMFWnDO3A08aC4ABO+OVgfB2q4n +4TD48KpeLuJ4O8k562cvkW8GZMc9Hq9tlPECR/HJ38zmj5ojopOGSqhdMKbarRNrRLXo Pd64llxmoduBE57kImxYRLW5/zbXXZPDWR8+EGh9ZlnvyZIyjekdDLaXEggI0NuvphQss DhLiFoxQNBJc67FTzmNVcdTP6In1xpfsr9x5797C29Qkeh2HQ8QUI6JgeyZEL6LkQuQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Z5smpzwp; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 57A66606A32C; Sat, 7 Nov 2026 15:25:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Z5smpzwp Received: by smtp.kernel.org (Postfix) with ESMTPSA id 06DE51F008A1; Sat, 7 Nov 2026 15:25:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794065108; bh=TjbYnNqNsoljep+RU99gw5UHeD9VOT9D04uLMaORjeg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Z5smpzwpCUEtz1uAqYgXlJ+iLXvRqiQ6vXOBl9UoWeNtTfbWLPivl3qk1Td8Bhion N4/AhjiqAUSdmlcWRCaTpbttMIBjpuYycWeXzJF4WSVLlt8oOGOEJLExnPC9cmO40Q cLZSP+RLfA0lqDTP9FeSbiQIEFOxmHnz+2ZmOGi4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Karl Mehltretter , Hyunchul Lee , Namjae Jeon , Sasha Levin Subject: [PATCH 7.3 0937/1257] ntfs: fix kunmap_local() of advanced pointers in check_mft_mirror() Date: Sat, 7 Nov 2026 08:53:53 -0500 Message-ID: <20261107135005.238473569@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Karl Mehltretter [ Upstream commit 16fcb1c446f17c11c104bd4e631b841946d180aa ] check_mft_mirror() compares the mft records of a page with the mirror records by advancing kmft and kmirr by the record size for every record. It then passes the advanced pointers to kunmap_local(). After the last record of a page they point one page past the mapping. With HIGHMEM kunmap_local() warns that the address does not match the top of the kmap_local stack. What it does next depends on how the architecture finds the page table entry: - 32-bit ARM looks the entry up by that address. It clears the entry of the neighbouring fixmap slot and leaves the real mapping in place. The next kmap_local() on that CPU that reaches the slot hits the BUG_ON(!pte_none()) in __kmap_local_pfn_prot(). - x86-32 takes the entry from the stack index, so the wrong address does not select a wrong entry. In QEMU the mount carried on after the warning. With 4 KiB pages and 1 KiB mft records the four mirror records fill exactly one page, so every mount whose $MFT and $MFTMirr folios are in highmem hits it. A fresh mkntfs volume on 32-bit ARM (multi_v7_defconfig, 256 MiB of highmem) fails on the first mount: WARNING: mm/highmem.c:623 at kunmap_local_indexed+0x254/0x26c, CPU#1: mount/85 kunmap_local_indexed from ntfs_fill_super+0x224c/0x35a0 ntfs_fill_super from get_tree_bdev_flags+0x1d8/0x2a4 ntfs: volume version 3.1, dev loop0, cluster size 4096 kernel BUG at mm/highmem.c:565! PC is at __kmap_local_pfn_prot+0x210/0x214 __kmap_local_page_prot from ntfs_check_logfile+0x1fc/0x1210 Found with syzkaller. Kernels without HIGHMEM do not show it. kmap_local_folio() returns the direct map address there and kunmap_local() has no mapping to remove. Keep the addresses returned by kmap_local_folio() and unmap with those. Fixes: 6251f0b0de7d ("ntfs: update super block operations") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Karl Mehltretter Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Sasha Levin --- fs/ntfs/super.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c index 6d70352136b0c..0a1faa262c417 100644 --- a/fs/ntfs/super.c +++ b/fs/ntfs/super.c @@ -1132,7 +1132,7 @@ static bool check_mft_mirror(struct ntfs_volume *vol) struct super_block *sb = vol->sb; struct ntfs_inode *mirr_ni; struct folio *mft_folio = NULL, *mirr_folio = NULL; - u8 *kmft = NULL, *kmirr = NULL; + u8 *kmft = NULL, *kmirr = NULL, *kmft_base = NULL, *kmirr_base = NULL; struct runlist_element *rl, rl2[2]; pgoff_t index; int mrecs_per_page, i; @@ -1147,9 +1147,9 @@ static bool check_mft_mirror(struct ntfs_volume *vol) /* Switch pages if necessary. */ if (!(i % mrecs_per_page)) { if (index) { - kunmap_local(kmirr); + kunmap_local(kmirr_base); folio_put(mirr_folio); - kunmap_local(kmft); + kunmap_local(kmft_base); folio_put(mft_folio); } /* Get the $MFT page. */ @@ -1159,7 +1159,8 @@ static bool check_mft_mirror(struct ntfs_volume *vol) ntfs_error(sb, "Failed to read $MFT."); return false; } - kmft = kmap_local_folio(mft_folio, 0); + kmft_base = kmap_local_folio(mft_folio, 0); + kmft = kmft_base; /* Get the $MFTMirr page. */ mirr_folio = read_mapping_folio(vol->mftmirr_ino->i_mapping, index, NULL); @@ -1167,7 +1168,8 @@ static bool check_mft_mirror(struct ntfs_volume *vol) ntfs_error(sb, "Failed to read $MFTMirr."); goto mft_unmap_out; } - kmirr = kmap_local_folio(mirr_folio, 0); + kmirr_base = kmap_local_folio(mirr_folio, 0); + kmirr = kmirr_base; ++index; } @@ -1179,10 +1181,10 @@ static bool check_mft_mirror(struct ntfs_volume *vol) "Incomplete multi sector transfer detected in mft record %i.", i); mm_unmap_out: - kunmap_local(kmirr); + kunmap_local(kmirr_base); folio_put(mirr_folio); mft_unmap_out: - kunmap_local(kmft); + kunmap_local(kmft_base); folio_put(mft_folio); return false; } @@ -1218,9 +1220,9 @@ static bool check_mft_mirror(struct ntfs_volume *vol) kmirr += vol->mft_record_size; } while (++i < vol->mftmirr_size); /* Release the last folios. */ - kunmap_local(kmirr); + kunmap_local(kmirr_base); folio_put(mirr_folio); - kunmap_local(kmft); + kunmap_local(kmft_base); folio_put(mft_folio); /* Construct the mft mirror runlist by hand. */ -- 2.53.0