[BUG] fs/ntfs3: setting a security xattr on an ADS dereferences NULL

[shaos]

Hello,

ADS inodes share the base file's MFT record, but ni_std5() passes the ADS inode's uninitialized mi to mi_find_attr().  Setting system.ntfs_security on an ADS reaches that helper and dereferences mi->mrec at NULL+0x18.  The crash is reachable with an ordinary setxattr() call by a user who owns the file.

HEAD commit:    fe2ec83746e501645709761605c2464a44fd2929
git tree:       upstream Linux checkout, local branch master
source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
compiler:       gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)

console output:
https://gist.githubusercontent.com/shaos26/a045de92005a251e1cc33b71f352de96/raw/00e77de3ad1fe8ba5df29f5b5d54619025579979/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/a045de92005a251e1cc33b71f352de96/raw/3a45887bd13dcef8a37d87699309038ddc0aa586/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/a045de92005a251e1cc33b71f352de96/raw/4d7823afe03fcbc7299266715ed014e776105dca/poc.c

Run in a disposable VM with a fresh read-write NTFS3 image mounted at /mnt with ads enabled.  The PoC starts as root, gives its base file to uid 1000, and performs the triggering setxattr as that user:

    dd if=/dev/zero of=/tmp/xattr.img bs=1M count=64 status=none
    mkntfs -F -q -L TEST -c 4096 -s 512 /tmp/xattr.img
    mkdir -p /mnt
    mount -t ntfs3 -o loop,ads,rw /tmp/xattr.img /mnt
    gcc -O2 -static -o ntfs3-ads-xattr-null poc.c
    ./ntfs3-ads-xattr-null
    dmesg | tail -60
    umount /mnt

Three fresh image runs and a uid 1000 run produced a NULL-pointer Oops at mi_enum_attr(), called by mi_find_attr() -> ni_std5() -> ntfs_setxattr().  Setting the same xattr on a base file and using ads=0 did not crash.

Impact and prerequisites:
A local user with write access to an NTFS3 file can trigger a kernel NULL dereference and denial of service when panic_on_oops is enabled.  No privilege escalation is demonstrated.

Validation: Three fresh-image positives, including a uid 1000 run, reproduced the NULL dereference.  Base-file and ads=0 controls were clean.

Thanks,

shaos