ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

Overview

In the Linux kernel, the following vulnerability has been resolved:

ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding mapping->invalidate_lock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and rewriting the runlist while the write fault maps blocks and dirties the folio. This races with ntfs_attr_fallocate(), which merges clusters into the in-memory runlist, drops the runlist lock, and only afterwards zeroes the newly allocated clusters on disk; and with the punch-hole/insert/collapse paths that free clusters after truncating the cache.

Per Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure there are no truncate/invalidate races, "usually mapping->invalidate_lock is suitable for proper serialization". xfs takes its mmaplock (= the invalidate_lock rwsem) shared in exactly this path.

Take invalidate_lock shared around iomap_page_mkwrite(). The read-only fault path is already covered because filemap_fault() itself grabs invalidate_lock shared on instantiation/read paths; only page_mkwrite was bypassing it in this driver.

Affected

• Linux >= 9c87959601e80b39a45250e362e6ddfec17cb0fa < 57c0d5281666d150c73e56e6795a4eef3ede8693
• Linux >= 9c87959601e80b39a45250e362e6ddfec17cb0fa < 0fecc393f2060e6bc25138df32cb923ec7071c6b
• Linux 7.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.