From: Szymon Wilczek <[email protected]>
Date: 22 Dec 2025
Subject: [PATCH] fs/ntfs3: fix deadlock in ni_read_folio_cmpr
Merged: 29 Dec 2025, by Konstantin Komarov
Syzbot reported a task hung in ni_readpage_cmpr (now ni_read_folio_cmpr). This is caused by a lock inversion deadlock involving the inode mutex (ni_lock) and page locks.
Scenario: 1. Task A enters ntfs_read_folio() for page X. It acquires ni_lock. 2. Task A calls ni_read_folio_cmpr(), which attempts to lock all pages in the compressed frame (including page Y). 3. Concurrently, Task B (e.g., via readahead) has locked page Y and calls ntfs_read_folio(). 4. Task B waits for ni_lock (held by A). 5. Task A waits for page Y lock (held by B). -> DEADLOCK.
The fix is to restructure locking: do not take ni_lock in ntfs_read_folio(). Instead, acquire ni_lock inside ni_read_folio_cmpr() ONLY AFTER all required page locks for the frame have been successfully acquired. This restores the correct lock ordering (Page Lock -> ni_lock) consistent with VFS.
signed, reported, fixes
- Reported-by syzbot reported it
- Fixes f35590ee26f5 the commit it fixes
- Signed-off-by Szymon Wilczek author
- Signed-off-by Konstantin Komarov maintainer · merged it
diff
@@ -2107,7 +2107,9 @@ int ni_read_folio_cmpr(struct ntfs_inode *ni, struct folio *folio) pages[i] = pg; } + ni_lock(ni); err = ni_read_frame(ni, frame_vbo, pages, pages_per_frame, 0);+ ni_unlock(ni); out1: for (i = 0; i < pages_per_frame; i++) {@@ -748,9 +748,8 @@ static int ntfs_read_folio(struct file *file, struct folio *folio) } if (is_compressed(ni)) {- ni_lock(ni);+ /* ni_lock is taken inside ni_read_folio_cmpr after page locks */ err = ni_read_folio_cmpr(ni, folio);- ni_unlock(ni); return err; } discussion · on the list
v1 · 2 messages
Szymon Wilczek author 22 Dec 2025
[PATCH] fs/ntfs3: fix deadlock in ni_readpage_cmpr
Konstantin Komarov maintainer 26 Dec 2025