On Mon, Aug 11, 2025 at 04:05:51PM +0900, Tetsuo Handa wrote: > Since ntfs_read_mft() not only accepts file modes which may_open() accepts > but also accepts > > (fname && fname->home.low == cpu_to_le32(MFT_REC_EXTEND) && > fname->home.seq == cpu_to_le16(MFT_REC_EXTEND) > > case when the file mode is none of > S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/S_IFIFO/S_IFSOCK, may_open() cannot > unconditionally expect IS_ANON_FILE(inode) when the file mode is none of > S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/S_IFIFO/S_IFSOCK. > > Treat as if S_IFREG when the inode is for NTFS3 filesystem. > > Reported-by: syzbot <syzbot+895c23f6917da440ed0d@xxxxxxxxxxxxxxxxxxxxxxxxx> > Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d > Fixes: af153bb63a33 ("vfs: catch invalid modes in may_open()") > Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> > --- > Is it possible to handle this problem on the NTFS3 side? > > --- a/fs/ntfs3/inode.c > +++ b/fs/ntfs3/inode.c > @@ -470,8 +470,9 @@ static struct inode *ntfs_read_mft(struct inode *inode, > } else if (fname && fname->home.low == cpu_to_le32(MFT_REC_EXTEND) && > fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) { > /* Records in $Extend are not a files or general directories. */ > inode->i_op = &ntfs_file_inode_operations; > + mode = S_IFREG; > } else { > err = -EINVAL; > goto out; > } > > I don't know what breaks if we pretend as if S_IFREG... > > fs/namei.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/fs/namei.c b/fs/namei.c > index cd43ff89fbaa..a66599754394 100644 > --- a/fs/namei.c > +++ b/fs/namei.c > @@ -3471,6 +3471,12 @@ static int may_open(struct mnt_idmap *idmap, const struct path *path, > return -EACCES; > break; > default: > + /* Special handling for ntfs_read_mft() case. */ > + if (inode->i_sb->s_magic == 0x7366746e) { > + if ((acc_mode & MAY_EXEC) && path_noexec(path)) > + return -EACCES; > + break; > + } > VFS_BUG_ON_INODE(!IS_ANON_FILE(inode), inode); > } > Bravo, but that's several months late - would be lovely for an AFD posting. In the current form the patch is obviously unacceptable; if we do that kind of special-casing, the proper place is in register_filesystem() where we clearly ought to compare fs->name with "ntfs" and return an error. All jokes aside, this kind of stuff is a non-starter. Blacklist it on syzbot side or fix fs/ntfs3; VFS is *NOT* the place for this kind of special-casing.
