FAILED: patch "[PATCH] fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and" failed to apply to 6.6-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 1abd643f3783ea8f8e273c18697ff0413aa92dc7
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026092904-porthole-attire-bdfd@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 1abd643f3783ea8f8e273c18697ff0413aa92dc7 Mon Sep 17 00:00:00 2001
From: Christian Brauner <[email protected]>
Date: Wed, 9 Sep 2026 11:03:18 +0200
Subject: [PATCH] fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and
murder syzbot's "WARNING in do_new_mount" saga
ntfs_create_inode() creates a new inode via ntfs_new_inode(). It hashes it with insert_inode_locked() and so it's marked as I_NEW until unlock_new_inode().
ntfs 3 calls d_instantiate() in between though... Since the dentry was already hashed by the lookup before the create any path walk finds it without touching the parent's i_rwsem and so can lock the inode.
If the inode is a directory unlock_new_inode() calls lockdep_annotate_inode_mutex_key() and marks i_rwsem with the i_mutex_dir_key class.
That resets the count and the owner of a lock somebody else may already hold by now...
syzbot has been spamming us with the same godforsaken bug
"WARNING in do_new_mount"
since 2023. I can't take it anymore so I went looking. Afaict, syzbot's executor chdirs into a freshly mounted ntfs3 image, creates a directory and then mounts some pseudofs on it. Everytime the mkdir() takes longer than syzbot waits mount() runs concurrently:
mkdir("./sys") mount(NULL, "./sys", "sysfs")
ntfs_create_inode()
d_instantiate()
user_path_at() finds the dentry
do_lock_mount()
inode_lock(inode)
namespace_lock()
unlock_new_inode()
lockdep_annotate_inode_mutex_key()
init_rwsem(&inode->i_rwsem)
unlock_mount()
inode_unlock(inode)The mount side then releases a lock that according to the rwsem nobody holds:
DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && ...):
count = 0x0, magic = 0xffff888043a854e8, owner = 0x0, curr 0xffff888000244880, list empty
WARNING: CPU: 0 PID: 5346 at kernel/locking/rwsem.c:1368 __up_write Call Trace: inode_unlock include/linux/fs.h:877 [inline] unlock_mount fs/namespace.c:2892 [inline] do_new_mount_fc fs/namespace.c:3828 [inline] do_new_mount+0x777/0xa40 fs/namespace.c:3887
On PREEMPT_RT the same thing shows up as
DEBUG_LOCKS_WARN_ON(rt_mutex_owner(lock) != current)
WARNING: kernel/locking/rtmutex_common.h:193 at rt_mutex_slowunlock
The up_write() underflows the reset count. A following inode_lock() on that directory then never returns. A path walk into the new directory racing with the mkdir() corrupts the lock the same way via inode_lock_shared() in lookup_slow().
Switch to d_instantiate_new() and drop the trailing unlock_new_inode(). All error paths bail out before that point with I_NEW still set and keep using discard_new_inode().
May we never see this fscking bug report again.
fs/ntfs3/inode.c +2 -5
@@ -1866,10 +1866,10 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, goto out6;/* -* Call 'd_instantiate' after inode->i_op is set +* Call 'd_instantiate_new' after inode->i_op is set * but before finish_open. */ -d_instantiate (dentry, inode); +d_instantiate_new (dentry, inode);/* Set original time. inode times (i_ctime) may be changed in ntfs_init_acl. */ inode_set_atime_to_ts (inode, ni->i_crtime);
@@ -1917,9 +1917,6 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,if (!fnd)ni_unlock (dir_ni); -if (!err) -unlock_new_inode (inode); -return err; }
Sasha Levin
maintainerPATCH 1/3 fs/ntfs3: remove atomic_open
From: Jeff Layton <[email protected]>
[ Upstream commit 93b4d70f6a4129fcfad18deae248bf89c129d1b5 ]
atomic_open is an optional VFS operation, and is primarily for network filesystems. NFS (for instance) can just send an open call for the last path component rather than doing a lookup and then having to follow that up with an open when it doesn't have a dentry in cache.
ntfs3 is a local filesystem however, and its atomic_open just does a typical lookup + open, but in a convoluted way. atomic_open will also make directory leases more difficult to implement on the filesystem.
Remove ntfs_atomic_open.
Backport preparation for 1abd643f3783ea8f8e273c18697ff0413aa92dc7:
Remove the stable version of ntfs_atomic_open(), which still uses mnt_idmap(file->f_path.mnt), while retaining the surrounding stable fixes.
Fold in the error-return conversion from c935c66878867 for ntfs_create_inode(), its declaration, and its four remaining callers. Keep the existing file allocation behavior; the unrelated resident-file creation change from that commit is not needed here.
Use the existing inode timestamp setters when restoring creation times. These equivalent assignments and the error-return cleanup provide the context needed for the target to apply unchanged. Keep d_instantiate() and the successful unlock_new_inode() here for the target to replace.
Stable-dep-of: 1abd643f3783 ("fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga")
--- fs/ntfs3/inode.c | 28 +++++------ fs/ntfs3/namei.c | 121 +++------------------------------------------ fs/ntfs3/ntfs_fs.h | 9 ++-- 3 files changed, 25 insertions(+), 133 deletions(-)
fs/ntfs3/inode.c +13 -15
@@ -1230,15 +1230,13 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,* - ntfs_mknod * - ntfs_symlink * - ntfs_mkdir -* - ntfs_atomic_open * -* NOTE: if fnd != NULL (ntfs_atomic_open) then @dir is locked +* NOTE: if fnd != NULL then @dir is locked */ -struct inode *ntfs_create_inode (struct mnt_idmap *idmap,struct inode *dir, -struct dentry *dentry, -const struct cpu_str *uni,umode_t mode, -dev_t dev,const char *symname,u32 size, -struct ntfs_fnd *fnd) +int ntfs_create_inode (struct mnt_idmap *idmap,struct inode *dir, +struct dentry *dentry,const struct cpu_str *uni, +umode_t mode,dev_t dev,const char *symname,u32 size, +struct ntfs_fnd *fnd) {int err;struct super_block *sb = dir->i_sb;
@@ -1705,9 +1703,11 @@ struct inode *ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,d_instantiate (dentry, inode);/* Set original time. inode times (i_ctime) may be changed in ntfs_init_acl. */ - inode->i_atime = inode->i_mtime = -inode_set_ctime_to_ts (inode, ni->i_crtime); - dir->i_mtime =inode_set_ctime_to_ts (dir, ni->i_crtime); +inode_set_atime_to_ts (inode, ni->i_crtime); +inode_set_ctime_to_ts (inode, ni->i_crtime); +inode_set_mtime_to_ts (inode, ni->i_crtime); +inode_set_mtime_to_ts (dir, ni->i_crtime); +inode_set_ctime_to_ts (dir, ni->i_crtime);mark_inode_dirty (dir);mark_inode_dirty (inode);
@@ -1748,12 +1748,10 @@ struct inode *ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,if (!fnd)ni_unlock (dir_ni); -if (err) -return ERR_PTR (err); - -unlock_new_inode (inode); +if (!err) +unlock_new_inode (inode); -return inode; +return err; }int ntfs_link_inode (struct inode *inode,struct dentry *dentry)
fs/ntfs3/namei.c +8 -113
161 lines not on this page · raw message
fs/ntfs3/ntfs_fs.h +4 -5
@@ -714,11 +714,10 @@ int ntfs_sync_inode(struct inode *inode);int ntfs_flush_inodes (struct super_block *sb,struct inode *i1,struct inode *i2);int inode_write_data (struct inode *inode,const void *data,size_t bytes); -struct inode *ntfs_create_inode (struct mnt_idmap *idmap,struct inode *dir, -struct dentry *dentry, -const struct cpu_str *uni,umode_t mode, -dev_t dev,const char *symname,u32 size, -struct ntfs_fnd *fnd); +int ntfs_create_inode (struct mnt_idmap *idmap,struct inode *dir, +struct dentry *dentry,const struct cpu_str *uni, +umode_t mode,dev_t dev,const char *symname,u32 size, +struct ntfs_fnd *fnd);int ntfs_link_inode (struct inode *inode,struct dentry *dentry);int ntfs_unlink_inode (struct inode *dir,const struct dentry *dentry);void ntfs_evict_inode (struct inode *inode);
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/3 fs/ntfs3: Redesign ntfs_create_inode to return error code instead of inode
From: Konstantin Komarov <[email protected]>
[ Upstream commit c935c66878867dc87c36c36b21d35d7e7f08adec ]
As Al Viro correctly pointed out, there is no need to return the whole structure to check the error.
https://lore.kernel.org/ntfs3/20240322023515.GK538574@ZenIV/
Stable-dep-of: 1abd643f3783 ("fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga")
--- fs/ntfs3/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ntfs3/inode.c +4 -1
@@ -1261,6 +1261,9 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,struct REPARSE_DATA_BUFFER *rp =NULL ;bool rp_inserted = false; +/* New file will be resident or non resident. */ +const bool new_file_resident =1 ; +if (!fnd)ni_lock_dir (dir_ni);
@@ -1500,7 +1503,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, attr->size =cpu_to_le32 (SIZEOF_RESIDENT ); attr->name_off =SIZEOF_RESIDENT_LE ; attr->res.data_off =SIZEOF_RESIDENT_LE ; - }else if (S_ISREG (mode)) { + }else if (!new_file_resident &&S_ISREG (mode)) {/* * Regular file. Create empty non resident data attribute. */
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/3 fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
In reply to Sasha LevinFrom: Christian Brauner <[email protected]>
[ Upstream commit 1abd643f3783ea8f8e273c18697ff0413aa92dc7 ]
ntfs_create_inode() creates a new inode via ntfs_new_inode(). It hashes it with insert_inode_locked() and so it's marked as I_NEW until unlock_new_inode().
ntfs 3 calls d_instantiate() in between though... Since the dentry was already hashed by the lookup before the create any path walk finds it without touching the parent's i_rwsem and so can lock the inode.
If the inode is a directory unlock_new_inode() calls lockdep_annotate_inode_mutex_key() and marks i_rwsem with the i_mutex_dir_key class.
That resets the count and the owner of a lock somebody else may already hold by now...
syzbot has been spamming us with the same godforsaken bug
"WARNING in do_new_mount"
since 2023. I can't take it anymore so I went looking. Afaict, syzbot's executor chdirs into a freshly mounted ntfs3 image, creates a directory and then mounts some pseudofs on it. Everytime the mkdir() takes longer than syzbot waits mount() runs concurrently:
mkdir("./sys") mount(NULL, "./sys", "sysfs")
ntfs_create_inode()
d_instantiate()
user_path_at() finds the dentry
do_lock_mount()
inode_lock(inode)
namespace_lock()
unlock_new_inode()
lockdep_annotate_inode_mutex_key()
init_rwsem(&inode->i_rwsem)
unlock_mount()
inode_unlock(inode)The mount side then releases a lock that according to the rwsem nobody holds:
DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && ...):
count = 0x0, magic = 0xffff888043a854e8, owner = 0x0, curr 0xffff888000244880, list empty
WARNING: CPU: 0 PID: 5346 at kernel/locking/rwsem.c:1368 __up_write Call Trace: inode_unlock include/linux/fs.h:877 [inline] unlock_mount fs/namespace.c:2892 [inline] do_new_mount_fc fs/namespace.c:3828 [inline] do_new_mount+0x777/0xa40 fs/namespace.c:3887
On PREEMPT_RT the same thing shows up as
DEBUG_LOCKS_WARN_ON(rt_mutex_owner(lock) != current)
WARNING: kernel/locking/rtmutex_common.h:193 at rt_mutex_slowunlock
The up_write() underflows the reset count. A following inode_lock() on that directory then never returns. A path walk into the new directory racing with the mkdir() corrupts the lock the same way via inode_lock_shared() in lookup_slow().
Switch to d_instantiate_new() and drop the trailing unlock_new_inode(). All error paths bail out before that point with I_NEW still set and keep using discard_new_inode().
May we never see this fscking bug report again.
--- fs/ntfs3/inode.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
fs/ntfs3/inode.c +2 -5
@@ -1700,10 +1700,10 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, goto out6;/* -* Call 'd_instantiate' after inode->i_op is set +* Call 'd_instantiate_new' after inode->i_op is set * but before finish_open. */ -d_instantiate (dentry, inode); +d_instantiate_new (dentry, inode);/* Set original time. inode times (i_ctime) may be changed in ntfs_init_acl. */ inode_set_atime_to_ts (inode, ni->i_crtime);
@@ -1751,9 +1751,6 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,if (!fnd)ni_unlock (dir_ni); -if (!err) -unlock_new_inode (inode); -return err; }
Signature · 1 line
2.53.0