Re: [PATCH 1/1] ntfs: add ioctl support for named data streams

[Hyunchul Lee]

> +
> +       bytes = ntfs_inode_attr_pwrite(attr_vi, offset, len, data_stream,
> +                                      false);
> +       if (bytes < 0)
> +               err = bytes;

offset is u64, but ntfs_inode_attr_pwrite takes s64.
If offset is U64_MAX and len = 1, pos becomes -1.
A resident stream can the reach memcpy(addr + pos, ...),
causing an out-of-bounds write.

> +static int ntfs_remove_named_stream(struct ntfs_inode *ni, __le16 *uname,
> +               u32 uname_len)
> +{
> +       if (!ni || !uname || uname_len == 0)
> +               return -EINVAL;
> +
> +       return ntfs_attr_remove(ni, AT_DATA, uname, uname_len);

Dirty folios are not guaranteed to be evicted before
ntfs_attr_rm() frees clusters. So invalidating
page caches seem to be needed.

And we have to serialize ntfs_attr_remove() against
other mft record modifications.

> +       case NTFS_STREAM_OP_WRITE:
> +               err = mnt_want_write_file(filp);
> +               if (err)
> +                       break;
> +               err = ntfs_write_named_stream(ni, sname, sname_len,
> +                                             req->stream_offset, req->io_len,
> +                                             kdata,
> +                                             &req->bytes_returned);
> +               mnt_drop_write_file(filp);
> +               if (!err) {
> +                       if (copy_to_user(&ureq->bytes_returned,
> +                                        &req->bytes_returned,
> +                                        sizeof(req->bytes_returned)))
> +                               err = -EFAULT;
> +               }
> +               break;
> +

We have to check NVolShutdown().