[BUG] fs/ntfs3: nocase lookups alias distinct ADS names

[BUG] fs/ntfs3: nocase lookups alias distinct ADS names

[shaos]

Hello,

With ads,nocase,iocharset=utf8, ntfs_d_hash() and the slow path in ntfs_d_compare() convert base:stream names but use only cpu_str.name and cpu_str.len.  They ignore ads_len and the stream name.  Two different Unicode ADS dentries such as carrier:é and carrier:ß therefore hash and compare as the same dentry, and the second open returns the first stream's contents.

HEAD commit:    5dd1818b15d98d4a20806cd00b1b40320b06004f
git tree:       upstream Linux checkout, local branch master
source version: v7.3-rc3-313-g5dd1818b15d98

console output:
https://gist.githubusercontent.com/shaos26/8ec54c999a8be8aed41f7cf3c2cd3a53/raw/33e333f56adce7cbdcf30c739a94d212d0de04f7/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/8ec54c999a8be8aed41f7cf3c2cd3a53/raw/98f68c316e64add97f6e7084b160ca561c103240/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/8ec54c999a8be8aed41f7cf3c2cd3a53/raw/3617a80a8398b22a9e0f15e9dd8cd0d30e0cba0a/poc.c

Create an NTFS image with two distinct Unicode named $DATA streams, then mount it read-only with ads and nocase enabled.  ntfscp is from ntfs-3g:

    dd if=/dev/zero of=/tmp/ntfs-ads.img bs=1M count=128 status=none
    mkntfs -F -q -c 4096 -s 512 /tmp/ntfs-ads.img
    printf 'BASE-CARRIER-CONTENT' > /tmp/base.txt
    printf 'ASCII-ADS-CONTENT\n' > /tmp/secret.txt
    printf 'OTHER-ASCII-ADS-CONTENT\n' > /tmp/other.txt
    printf 'UNICODE-ADS-CONTENT\n' > /tmp/stream-e.txt
    printf 'SECOND-UNICODE-ADS-CONTENT\n' > /tmp/stream-ss.txt
    ntfscp -q -f /tmp/ntfs-ads.img /tmp/base.txt carrier
    ntfscp -q -f -N secret /tmp/ntfs-ads.img /tmp/secret.txt carrier
    ntfscp -q -f -N other /tmp/ntfs-ads.img /tmp/other.txt carrier
    ntfscp -q -f -N 'é' /tmp/ntfs-ads.img /tmp/stream-e.txt carrier
    ntfscp -q -f -N 'ß' /tmp/ntfs-ads.img /tmp/stream-ss.txt carrier
    mkdir -p /mnt/ntfs
    mount -t ntfs3 -o loop,ads,ro,nocase,iocharset=utf8 /tmp/ntfs-ads.img /mnt/ntfs
    cc -O2 -Wall -Wextra -o ntfs3_ads_dentry_alias poc.c
    ./ntfs3_ads_dentry_alias /mnt/ntfs carrier:é carrier:ß \
        UNICODE-ADS-CONTENT SECOND-UNICODE-ADS-CONTENT
    umount /mnt/ntfs

The trigger reproduced in both opening orders and returned the first stream's bytes for both names.  ASCII stream names and the same Unicode streams without nocase returned their distinct expected contents.  The KASAN-configured run showed no memory fault.

Impact and prerequisites:
This is an object-confusion and data-integrity bug, not memory corruption.  It requires an NTFS volume containing distinct non-ASCII ADS names and an explicit nocase mount; no privilege escalation is demonstrated.

Validation: The alias reproduced in both lookup orders.  ASCII-name and case-sensitive controls returned their expected contents, and the KASAN-enabled run reported no memory fault.

Thanks,

shaos