From: Szymon Wilczek <[email protected]>
Date: 27 Dec 2025
Subject: [PATCH] ntfs3: fix circular locking dependency in run_unpack_ex
Merged: 15 Jan 2026, by Konstantin Komarov
Syzbot reported a circular locking dependency between wnd->rw_lock (sbi->used.bitmap) and ni->file.run_lock.
The deadlock scenario: 1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock. 2. run_unpack_ex() takes wnd->rw_lock then tries to acquire ni->file.run_lock inside ntfs_refresh_zone().
This creates an AB-BA deadlock.
Fix this by using down_read_trylock() instead of down_read() when acquiring run_lock in run_unpack_ex(). If the lock is contended, skip ntfs_refresh_zone() - the MFT zone will be refreshed on the next MFT operation. This breaks the circular dependency since we never block waiting for run_lock while holding wnd->rw_lock.
signed, reported, fixes
- Reported-by syzbot reported it
- Tested-by syzbot tested it
- Signed-off-by Szymon Wilczek author
- Signed-off-by Konstantin Komarov maintainer · merged it
diff
@@ -1131,11 +1131,14 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, struct rw_semaphore *lock = is_mounted(sbi) ? &sbi->mft.ni->file.run_lock : NULL;- if (lock)- down_read(lock);- ntfs_refresh_zone(sbi);- if (lock)- up_read(lock);+ if (lock) {+ if (down_read_trylock(lock)) {+ ntfs_refresh_zone(sbi);+ up_read(lock);+ }+ } else {+ ntfs_refresh_zone(sbi);+ } } up_write(&wnd->rw_lock); if (err)discussion · on the list
v1 · 2 messages
Szymon Wilczek author 27 Dec 2025
[PATCH] ntfs3: fix circular locking dependency in run_unpack_ex
Konstantin Komarov maintainer 16 Jan 2026