Merge tag 'ntfs3_for_7.2' of https://github.com/Paragon-Software-Group/linux-ntfs3

Pull ntfs3 updates from Konstantin Komarov:
 "Added:
   - depth limit to indx_find_buffer() to prevent stack overflow
   - validate split-point offset in indx_insert_into_buffer()
   - bounds check to run_get_highest_vcn()
   - fileattr_get() and fileattr_set() support
   - zero stale pagecache beyond valid data length
   - handle delayed allocation overlap in run lookup
   - validate lcns_follow in log_replay() conversion
   - cap RESTART_TABLE free-chain walker at rt->used
   - resize log->one_page_buf when adopting on-disk page size
   - reject direct userspace writes to reserved $LX* xattrs

  Fixed:
   - out-of-bounds read in decompress_lznt()
   - avoid -Wmaybe-uninitialized warnings
   - hold ni_lock across readdir metadata walk
   - preserve non-DOS attribute bits in system.dos_attrib
   - validate index entry key bounds
   - syncing wrong inode on DIRSYNC cross-directory rename
   - validate Dirty Page Table capacity in log_replay() copy_lcns
   - wrong LCN in run_remove_range() when splitting a run
   - allocate iomap inline_data using alloc_page
   - mount failure on 64K page-size kernels
   - out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
   - bound attr_off in UpdateResidentValue against data_off
   - bound DeleteIndexEntryAllocation memmove length
   - bound copy_lcns dp->page_lcns[] index in analysis pass
   - bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
   - prevent potential lcn remains uninitialized

  Changed:
   - bound to_move in indx_insert_into_root() before hdr_insert_head()
   - call _ntfs_bad_inode() when failing to rename
   - fold resident writeback into writepages loop
   - force waiting for direct I/O completion
   - fold file size handling into ntfs_set_size()
   - reject SEEK_DATA and SEEK_HOLE past EOF early
   - format code, add descriptive comments and remove non-useful"

* tag 'ntfs3_for_7.2' of https://github.com/Paragon-Software-Group/linux-ntfs3: (34 commits)
  ntfs3: reject direct userspace writes to reserved $LX* xattrs
  fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
  fs/ntfs3: prevent potential lcn remains uninitialized
  ntfs3: cap RESTART_TABLE free-chain walker at rt->used
  fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
  fs/ntfs3: validate lcns_follow in log_replay conversion
  fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
  fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
  fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
  ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
  fs/ntfs3: fix mount failure on 64K page-size kernels
  ntfs3: avoid another -Wmaybe-uninitialized warning
  ntfs3: Allocate iomap inline_data using alloc_page
  fs/ntfs3: format code, deal with comments
  fs/ntfs3: reject SEEK_DATA and SEEK_HOLE past EOF early
  fs/ntfs3: fold file size handling into ntfs_set_size()
  fs/ntfs3: force waiting for direct I/O completion
  fs/ntfs3: fold resident writeback into writepages loop
  fs/ntfs3: handle delayed allocation overlap in run lookup
  fs/ntfs3: zero stale pagecache beyond valid data length
  ...

Author: torvalds

fs/ntfs3/attrib.c

@@ -962,11 +962,8 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn,
 
 	/* Try to find in cache. */
 	down_read(&ni->file.run_lock);
-	if (!no_da && run_lookup_entry(&ni->file.run_da, vcn, lcn, len, NULL)) {
-		/* The requested vcn is delay allocated. */
-		*lcn = DELALLOC_LCN;
-	} else if (run_lookup_entry(&ni->file.run, vcn, lcn, len, NULL)) {
-		/* The requested vcn is known in current run. */
+	if (run_lookup_entry_da(&ni->file.run, !no_da ? &ni->file.run_da : NULL,
+				vcn, lcn, len)) {
 	} else {
 		*len = 0;
 	}
@@ -1004,18 +1001,16 @@ int attr_data_get_block_locked(struct ntfs_inode *ni, CLST vcn, CLST clen,
 	struct ATTRIB *attr, *attr_b;
 	struct ATTR_LIST_ENTRY *le, *le_b;
 	struct mft_inode *mi, *mi_b;
+	struct page *page;
 	CLST hint, svcn, to_alloc, evcn1, next_svcn, asize, end, vcn0;
 	CLST alloc, evcn;
 	unsigned fr;
 	u64 total_size, total_size0;
 	int step;
 
 again:
-	if (da && run_lookup_entry(run_da, vcn, lcn, len, NULL)) {
-		/* The requested vcn is delay allocated. */
-		*lcn = DELALLOC_LCN;
-	} else if (run_lookup_entry(run, vcn, lcn, len, NULL)) {
-		/* The requested vcn is known in current run. */
+	if (run_lookup_entry_da(run, da ? &ni->file.run_da : NULL, vcn, lcn,
+				len)) {
 	} else {
 		*len = 0;
 	}
@@ -1042,10 +1037,13 @@ int attr_data_get_block_locked(struct ntfs_inode *ni, CLST vcn, CLST clen,
 		*lcn = RESIDENT_LCN;
 		*len = data_size;
 		if (res && data_size) {
-			*res = kmemdup(resident_data(attr_b), data_size,
-				       GFP_KERNEL);
-			if (!*res)
+			page = alloc_page(GFP_KERNEL);
+			if (!page) {
 				err = -ENOMEM;
+			} else {
+				*res = page_address(page);
+				memcpy(*res, resident_data(attr_b), data_size);
+			}
 		}
 		goto out;
 	}
@@ -1100,7 +1098,8 @@ int attr_data_get_block_locked(struct ntfs_inode *ni, CLST vcn, CLST clen,
 	}
 
 	if (!*len) {
-		if (run_lookup_entry(run, vcn, lcn, len, NULL)) {
+		if (run_lookup_entry_da(run, da ? run_da : NULL, vcn, lcn,
+					len)) {
 			if (*lcn != SPARSE_LCN || !new)
 				goto ok; /* Slow normal way without allocation. */
 
@@ -1157,7 +1156,7 @@ int attr_data_get_block_locked(struct ntfs_inode *ni, CLST vcn, CLST clen,
 			struct ATTRIB *attr2;
 
 			attr2 = ni_find_attr(ni, attr_b, &le_b, ATTR_DATA, NULL,
-					       0, &vcn0, &mi);
+					     0, &vcn0, &mi);
 			if (!attr2) {
 				err = -EINVAL;
 				goto out;

fs/ntfs3/dir.c

@@ -305,7 +305,9 @@ static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi,
 	if (sbi->options->nohidden && (fname->dup.fa & FILE_ATTRIBUTE_HIDDEN))
 		return true;
 
-	if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size))
+	if (sizeof(struct NTFS_DE) +
+	    offsetof(struct ATTR_FILE_NAME, name) +
+	    fname->name_len * sizeof(short) > le16_to_cpu(e->size))
 		return true;
 
 	name_len = ntfs_utf16_to_nls(sbi, fname->name, fname->name_len, name,
@@ -489,10 +491,17 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
 			goto out;
 	}
 
+	/*
+	 * Keep directory metadata stable for the whole walk. Loading subrecords
+	 * once is not enough if concurrent writeback can still compact ATTR_LIST
+	 * entries and free the record that ntfs_read_hdr() is currently walking.
+	 */
+	ni_lock(ni);
+
 	root = indx_get_root(&ni->dir, ni, NULL, NULL);
 	if (!root) {
 		err = -EINVAL;
-		goto out;
+		goto out_unlock;
 	}
 
 	if (pos >= sbi->record_size) {
@@ -503,7 +512,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
 		 */
 		err = ntfs_read_hdr(sbi, ni, &root->ihdr, 0, pos, name, ctx);
 		if (err)
-			goto out;
+			goto out_unlock;
 		bit = 0;
 	}
 
@@ -514,7 +523,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
 		/* Get the next used index. */
 		err = indx_used_bit(&ni->dir, ni, &bit);
 		if (err)
-			goto out;
+			goto out_unlock;
 
 		if (bit == MINUS_ONE_T) {
 			/* no more used indexes. end of dir. */
@@ -524,13 +533,13 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
 		if (bit >= max_bit) {
 			/* Corrupted directory. */
 			err = -EINVAL;
-			goto out;
+			goto out_unlock;
 		}
 
 		err = indx_read_ra(&ni->dir, ni, bit << ni->dir.idx2vbn_bits,
 				   &node, &file->f_ra);
 		if (err)
-			goto out;
+			goto out_unlock;
 
 		/*
 		 * Add each name from index in 'ctx'.
@@ -539,9 +548,12 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
 				    ((u64)bit << index_bits) + sbi->record_size,
 				    pos, name, ctx);
 		if (err)
-			goto out;
+			goto out_unlock;
 	}
 
+out_unlock:
+	ni_unlock(ni);
+
 out:
 	kfree(name);
 	put_indx_node(node);