Re: [PATCH] ntfs: validate error codes in check_windows_hibernation_status()

[Hongling Zeng <zhongling0719@126.com>]

Looking at ntfs_lookup_inode_by_name() more carefully:

All error return paths inside the function use hardcoded kernel errnos
(MREF_ERR(-ENOENT), MREF_ERR(-EIO), MREF_ERR(-ENOMEM)) - these are
already valid by construction.

The actual risk occurs when the function returns a "successful" MFT
reference from disk (ie->data.dir.indexed_file) that happens to have
bit 47 set - making IS_ERR_MREF() true at the caller. In this case,
MREF_ERR() extracts garbage from untrusted disk data.

This cannot be fixed inside ntfs_lookup_inode_by_name() without
changing its return value semantics, because from the function's
perspective it found a matching index entry and returned it. Only
the caller, after IS_ERR_MREF() triggers, is in a position to
validate that the extracted error code is a legitimate errno.

Restructuring the function to distinguish "real errors I generated"
from "disk data that looks like an error" would require a more
invasive API change (e.g., returning int + out-parameter), which
seems inappropriate for a legacy filesystem in maintenance mode.

在 2026年07月03日 15:06, Namjae Jeon 写道:
> On Thu, Jul 2, 2026 at 12:37 PM Hongling Zeng <zenghongling@kylinos.cn> wrote:
>> check_windows_hibernation_status() calls ntfs_lookup_inode_by_name()
>> which returns MFT references read directly from disk (untrusted data).
>> The current code extracts error codes via MREF_ERR() without proper
>> validation, allowing maliciously crafted NTFS images to trigger
>> incorrect error handling.
>>
>> The MFT reference encoding uses bit 47 as an error indicator, but the
>> lower 32 bits can contain arbitrary values. If a malicious image sets
>> the error bit with a positive integer (e.g., 1), MREF_ERR() returns
>> that positive value. This can cause the function to incorrectly
>> interpret the error as "Windows is hibernated" status, potentially
>> leading to the filesystem being mounted read-only (denial of service).
>>
>> Fix by strictly validating error codes: only accept negative values
>> in the valid errno range [-MAX_ERRNO, -1]. Convert all other values
>> (positive, zero, or out-of-range) to -EIO to indicate disk corruption.
>>
>> This prevents potential security issues and ensures proper error handling
>> for corrupted or malicious NTFS filesystems.
>>
>> Fixes: 1e9ea7e04472d ("Revert \"fs: Remove NTFS classic\"")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
> I think this should be fixed in ntfs_lookup_inode_by_name(), rather
> than in the caller.
> And I will revert your previous patch ("ntfs: validate error codes
> from untrusted disk data").
>
> Thanks.