From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> stable inclusion from stable-v6.6.60 commit 550ef40fa6366d5d11b122e5f36b1f9aa20c087e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A2 CVE: CVE-2024-50242 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 031d6f608290c847ba6378322d0986d08d1a645a ] Reported-by: syzbot+8c652f14a0fde76ff11d@syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4@huawei.com> --- fs/ntfs3/file.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c index f14d21b6c6d3..2ecd0303f942 100644 --- a/fs/ntfs3/file.c +++ b/fs/ntfs3/file.c @@ -1173,7 +1173,14 @@ static int ntfs_file_release(struct inode *inode, struct file *file) /* If we are last writer on the inode, drop the block reservation. */ if (sbi->options->prealloc && ((file->f_mode & FMODE_WRITE) && - atomic_read(&inode->i_writecount) == 1)) { + atomic_read(&inode->i_writecount) == 1) + /* + * The only file when inode->i_fop = &ntfs_file_operations and + * init_rwsem(&ni->file.run_lock) is not called explicitly is MFT. + * + * Add additional check here. + */ + && inode->i_ino != MFT_REC_MFT) { ni_lock(ni); down_write(&ni->file.run_lock); -- 2.39.2