Re: [PATCH v2] ntfs: prevent write access to $MFT inode

[Hongling Zeng]

  Hi Namjae,

  Excellent solution! Your S_IMMUTABLE flag approach is much better 
than my function-level checks.

  I've validated that your patch comprehensively blocks all attack 
vectors:
  - write(), truncate(), fallocate(), mmap() - All protected via VFS layer
  - Single modification vs. multiple function checks - Much more elegant
  - Zero runtime overhead - Performance efficient

  Your insights about the $Bitmap deadlock issue and directory handling 
show deep understanding of NTFS architecture.

  This solution would also make excellent patent material - the 
VFS-level protection mechanism is both innovative and effective.


  Best regards,
  Hongling Zeng

在 2026年07月02日 20:12, Namjae Jeon 写道:
> On Thu, Jul 2, 2026 at 6:06 PM Hongling Zeng <zenghongling@xxxxxxxxxx> wrote:
> > Malicious NTFS images can expose $MFT to userspace and allow write
> > operations, leading to potential kernel NULL pointer dereference
> > since ntfs_mft_aops lacks write_begin support.
> >
> > The vulnerability affects both write_iter and mmap-based write paths:
> > 1. write_iter path: ntfs_file_write_iter()
> > 2. mmap write path: ntfs_filemap_page_mkwrite()
> >
> > Without protecting both paths, attackers can bypass single-path
> > protection by using the alternative write method.
> >
> > Fix by adding write protection in ntfs_file_write_iter() to prevent
> > any write operations to FILE_MFT.
> >
> > Fixes: 1e9ea7e04472d ("Revert \"fs: Remove NTFS classic\"")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
> Can you check if the attached file fixes this issue ?
> Thanks.