Re: [PATCH v4] ntfs: validate error codes from untrusted disk data

[Namjae Jeon]

On Wed, Jul 1, 2026 at 4:42 PM Hongling Zeng <zenghongling@xxxxxxxxxx> wrote:
>
> ntfs_lookup_ino_by_name() returns MFT references read directly from
> disk, which are untrusted data. The current code extracts error codes
> via MREF_ERR() without proper validation, allowing maliciously crafted
> NTFS images to trigger kernel panic.
>
> The MFT reference encoding uses bit 47 as an error indicator, but the
> lower 32 bits can contain arbitrary values. If a malicious image sets
> the error bit with a positive integer (e.g., 1), MREF_ERR() returns
> that positive value. Returning ERR_PTR(1) causes VFS to treat it as
> a valid dentry pointer since IS_ERR() only recognizes values in
> [-MAX_ERRNO, -1] as errors.
>
> This leads to kernel panic when walk_component() → step_into()
> dereferences the bogus pointer at:
>     struct inode *inode = dentry->d_inode;
>
> Fix by strictly validating error codes: only accept negative values
> in the valid errno range [-MAX_ERRNO, -1]. Convert all other values
> (positive, zero, or out-of-range) to -EIO to indicate disk corruption.
>
> This prevents potential security issues and ensures proper error handling
> for corrupted or malicious NTFS filesystems.
>
> Fixes: 1e9ea7e04472d ("Revert \"fs: Remove NTFS classic\"")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
> Suggested-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Applied it to #ntfs-next.
Thanks!