linux-kernel - [RFC PATCH] vfs: exclude ntfs3 from file mode validation in may

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <fb3888fb-11b8-481b-86a6-766bbbab5c81@I-love.SAKURA.ne.jp>
Date: Mon, 11 Aug 2025 16:05:51 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: Alexander Viro <viro@...iv.linux.org.uk>,
        Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
        Mateusz Guzik <mjguzik@...il.com>,
        Konstantin Komarov <almaz.alexandrovich@...agon-software.com>
Cc: linux-fsdevel <linux-fsdevel@...r.kernel.org>, ntfs3@...ts.linux.dev,
        LKML <linux-kernel@...r.kernel.org>
Subject: [RFC PATCH] vfs: exclude ntfs3 from file mode validation in
 may_open()

Since ntfs_read_mft() not only accepts file modes which may_open() accepts
but also accepts

  (fname && fname->home.low == cpu_to_le32(MFT_REC_EXTEND) &&
   fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)

case when the file mode is none of
S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/S_IFIFO/S_IFSOCK, may_open() cannot
unconditionally expect IS_ANON_FILE(inode) when the file mode is none of
S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/S_IFIFO/S_IFSOCK.

Treat as if S_IFREG when the inode is for NTFS3 filesystem.

Reported-by: syzbot <syzbot+895c23f6917da440ed0d@...kaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Fixes: af153bb63a33 ("vfs: catch invalid modes in may_open()")
Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
---
Is it possible to handle this problem on the NTFS3 side?

  --- a/fs/ntfs3/inode.c
  +++ b/fs/ntfs3/inode.c
  @@ -470,8 +470,9 @@ static struct inode *ntfs_read_mft(struct inode *inode,
          } else if (fname && fname->home.low == cpu_to_le32(MFT_REC_EXTEND) &&
                     fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) {
                  /* Records in $Extend are not a files or general directories. */
                  inode->i_op = &ntfs_file_inode_operations;
  +               mode = S_IFREG;
          } else {
                  err = -EINVAL;
                  goto out;
          }

I don't know what breaks if we pretend as if S_IFREG...

 fs/namei.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/namei.c b/fs/namei.c
index cd43ff89fbaa..a66599754394 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3471,6 +3471,12 @@ static int may_open(struct mnt_idmap *idmap, const struct path *path,
 			return -EACCES;
 		break;
 	default:
+		/* Special handling for ntfs_read_mft() case. */
+		if (inode->i_sb->s_magic == 0x7366746e) {
+			if ((acc_mode & MAY_EXEC) && path_noexec(path))
+				return -EACCES;
+			break;
+		}
 		VFS_BUG_ON_INODE(!IS_ANON_FILE(inode), inode);
 	}
 
-- 
2.50.1