Re: [PATCH v2] ntfs: prevent write access to $MFT inode

[Namjae Jeon]

On Thu, Jul 2, 2026 at 6:06 PM Hongling Zeng <zenghongling@xxxxxxxxxx> wrote:
>
> Malicious NTFS images can expose $MFT to userspace and allow write
> operations, leading to potential kernel NULL pointer dereference
> since ntfs_mft_aops lacks write_begin support.
>
> The vulnerability affects both write_iter and mmap-based write paths:
> 1. write_iter path: ntfs_file_write_iter()
> 2. mmap write path: ntfs_filemap_page_mkwrite()
>
> Without protecting both paths, attackers can bypass single-path
> protection by using the alternative write method.
>
> Fix by adding write protection in ntfs_file_write_iter() to prevent
> any write operations to FILE_MFT.
>
> Fixes: 1e9ea7e04472d ("Revert \"fs: Remove NTFS classic\"")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
Can you check if the attached file fixes this issue ?
Thanks.
From 1d9ec40feffcf2d054df01b58564334977ecdf9b Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Date: Thu, 2 Jul 2026 20:36:59 +0900
Subject: [PATCH] ntfs: make system files immutable to prevent corruption

When a system file such as $Bitmap is exposed via show_sys_files and
written from userspace, the volume is corrupted and, because the cluster
allocator scans $Bitmap through the same inode's page cache, a write to
$Bitmap also deadlocks writeback against the folio it already holds locked.

These files are maintained by the driver itself and have no valid reason
to be written through the file interface. Mark base metadata files
(mft_no < FILE_first_user) as immutable during inode read so the VFS
rejects write, mmap, truncate and unlink with -EPERM. Directories are
skipped so the root and $Extend remain usable. Internal metadata updates
do not go through the VFS write path and are unaffected.

Signed-off-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
---
 fs/ntfs/inode.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index c2715521e562..7381a18cfadd 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -1191,6 +1191,15 @@ static int ntfs_read_locked_inode(struct inode *vi)
 	    !S_ISFIFO(vi->i_mode) && !S_ISSOCK(vi->i_mode) && !S_ISLNK(vi->i_mode))
 		vi->i_flags |= S_IMMUTABLE;
 
+	/*
+	 * System files such as $Bitmap and $MFT are maintained by the driver
+	 * itself, and writing them from userspace corrupts the volume.
+	 * Always make them immutable regardless of the sys_immutable option.
+	 * Directories are skipped so the root and $Extend stay usable.
+	 */
+	if (ni->mft_no < FILE_first_user && S_ISREG(vi->i_mode))
+		vi->i_flags |= S_IMMUTABLE;
+
 	/*
 	 * The number of 512-byte blocks used on disk (for stat). This is in so
 	 * far inaccurate as it doesn't account for any named streams or other
-- 
2.25.1