linux-kernel - [PATCH 02/16] fs/ntfs3: Modified fix directory element type detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 6 Dec 2023 18:09:45 +0300
From:   Konstantin Komarovc <almaz.alexandrovich@...agon-software.com>
To:     <ntfs3@...ts.linux.dev>
CC:     <linux-kernel@...r.kernel.org>, <linux-fsdevel@...r.kernel.org>
Subject: [PATCH 02/16] fs/ntfs3: Modified fix directory element type detection

Unfortunately reparse attribute is used for many purposes (several dozens).
It is not possible here to know is this name symlink or not.
To get exactly the type of name we should to open inode (read mft).
getattr for opened file (fstat) correctly returns symlink.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@...agon-software.com>
---
  fs/ntfs3/dir.c | 30 +++++++++++++++++++++++++-----
  1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index ec0566b322d5..22ede4da0450 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -309,11 +309,31 @@ static inline int ntfs_filldir(struct ntfs_sb_info 
*sbi, struct ntfs_inode *ni,
          return 0;
      }

-    /* NTFS: symlinks are "dir + reparse" or "file + reparse" */
-    if (fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT)
-        dt_type = DT_LNK;
-    else
-        dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : 
DT_REG;
+    /*
+     * NTFS: symlinks are "dir + reparse" or "file + reparse"
+     * Unfortunately reparse attribute is used for many purposes 
(several dozens).
+     * It is not possible here to know is this name symlink or not.
+     * To get exactly the type of name we should to open inode (read mft).
+     * getattr for opened file (fstat) correctly returns symlink.
+     */
+    dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG;
+
+    /*
+     * It is not reliable to detect the type of name using duplicated 
information
+     * stored in parent directory.
+     * The only correct way to get the type of name - read MFT record 
and find ATTR_STD.
+     * The code below is not good idea.
+     * It does additional locks/reads just to get the type of name.
+     * Should we use additional mount option to enable branch below?
+     */
+    if ((fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) &&
+        ino != ni->mi.rno) {
+        struct inode *inode = ntfs_iget5(sbi->sb, &e->ref, NULL);
+        if (!IS_ERR_OR_NULL(inode)) {
+            dt_type = fs_umode_to_dtype(inode->i_mode);
+            iput(inode);
+        }
+    }

      return !dir_emit(ctx, (s8 *)name, name_len, ino, dt_type);
  }
-- 
2.34.1