Re: [PATCH] ntfs: validate error codes in check_windows_hibernation_status()

[Hongling Zeng]

Looking at ntfs_lookup_inode_by_name() more carefully:

All error return paths inside the function use hardcoded kernel errnos
(MREF_ERR(-ENOENT), MREF_ERR(-EIO), MREF_ERR(-ENOMEM)) - these are
already valid by construction.

The actual risk occurs when the function returns a "successful" MFT
reference from disk (ie->data.dir.indexed_file) that happens to have
bit 47 set - making IS_ERR_MREF() true at the caller. In this case,
MREF_ERR() extracts garbage from untrusted disk data.

This cannot be fixed inside ntfs_lookup_inode_by_name() without
changing its return value semantics, because from the function's
perspective it found a matching index entry and returned it. Only
the caller, after IS_ERR_MREF() triggers, is in a position to
validate that the extracted error code is a legitimate errno.

Restructuring the function to distinguish "real errors I generated"
from "disk data that looks like an error" would require a more
invasive API change (e.g., returning int + out-parameter), which
seems inappropriate for a legacy filesystem in maintenance mode.

在 2026年07月03日 15:06, Namjae Jeon 写道:
> On Thu, Jul 2, 2026 at 12:37 PM Hongling Zeng <zenghongling@xxxxxxxxxx> wrote:
> > check_windows_hibernation_status() calls ntfs_lookup_inode_by_name()
> > which returns MFT references read directly from disk (untrusted data).
> > The current code extracts error codes via MREF_ERR() without proper
> > validation, allowing maliciously crafted NTFS images to trigger
> > incorrect error handling.
> >
> > The MFT reference encoding uses bit 47 as an error indicator, but the
> > lower 32 bits can contain arbitrary values. If a malicious image sets
> > the error bit with a positive integer (e.g., 1), MREF_ERR() returns
> > that positive value. This can cause the function to incorrectly
> > interpret the error as "Windows is hibernated" status, potentially
> > leading to the filesystem being mounted read-only (denial of service).
> >
> > Fix by strictly validating error codes: only accept negative values
> > in the valid errno range [-MAX_ERRNO, -1]. Convert all other values
> > (positive, zero, or out-of-range) to -EIO to indicate disk corruption.
> >
> > This prevents potential security issues and ensures proper error handling
> > for corrupted or malicious NTFS filesystems.
> >
> > Fixes: 1e9ea7e04472d ("Revert \"fs: Remove NTFS classic\"")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
> I think this should be fixed in ntfs_lookup_inode_by_name(), rather
> than in the caller.
> And I will revert your previous patch ("ntfs: validate error codes
> from untrusted disk data").
>
> Thanks.