fs/ntfs3: Additional check in ntfs_file_release

[ Upstream commit 031d6f608290c847ba6378322d0986d08d1a645a ]

Reported-by: syzbot+8c652f14a0fde76ff11d@syzkaller.appspotmail.com
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
index aedd4f5f459e6827e9972dd6d079622fac235bfa..70b38465aee36486646044e6fd15f3b48cb8cdd6 100644 (file)
--- a/fs/ntfs3/file.c
+++ b/fs/ntfs3/file.c
@@ -1214,8 +1214,16 @@ static int ntfs_file_release(struct inode *inode, struct file *file)
        int err = 0;
 
        /* If we are last writer on the inode, drop the block reservation. */
-       if (sbi->options->prealloc && ((file->f_mode & FMODE_WRITE) &&
-                                     atomic_read(&inode->i_writecount) == 1)) {
+       if (sbi->options->prealloc &&
+           ((file->f_mode & FMODE_WRITE) &&
+            atomic_read(&inode->i_writecount) == 1)
+          /*
+           * The only file when inode->i_fop = &ntfs_file_operations and
+           * init_rwsem(&ni->file.run_lock) is not called explicitly is MFT.
+           *
+           * Add additional check here.
+           */
+           && inode->i_ino != MFT_REC_MFT) {
                ni_lock(ni);
                down_write(&ni->file.run_lock);