Re: [PATCH] ntfs3: prevent operations on NTFS system files

[Deepanshu Kartikey]

Hi Tetsuo,

Thank you for testing on a legitimate filesystem and for your question.

I'm trying to understand the protection mechanism better. When I searched
for ENXIO in fs/ntfs3/, I didn't find any explicit checks. Could you help
me understand where the ENXIO is coming from in your test?

I noticed that in the $Extend code path, inode->i_fop doesn't appear to
be set (only i_op is set), unlike regular files. Could this be why
operations fail on legitimate filesystems?

Regarding the syzbot reproducer - it uses a malformed filesystem image
from the fuzzer. I'm wondering if such corrupted images might bypass the
normal protections and reach ntfs_setattr() in ways that don't happen on
proper filesystems.

Would it make sense to add an explicit check in ntfs_setattr() to reject
size changes on system inodes (rno < MFT_REC_FREE) as additional
protection? Or do you think Edward's patch (just initializing the lock)
is sufficient?

I'd appreciate your guidance on the right approach here.

Best regards,
Deepanshu