[PATCH 0/3] ntfs: three fixes for crafted images, found by fuzzing

[Wahid Khan <wahidzk0091@gmail.com>]

I fuzz the new fs/ntfs driver with mutated images: an image from mkntfs
populated with ntfs-3g (directories, streams, sparse files, long names), a
few bytes changed, then mount, walk the tree and write, under KASAN.
Three problems from that are still present in ntfs-next (e62b384ca).
Each patch has its own trace and the reproduction steps.

1. ntfs: do not read an index block outside $INDEX_ALLOCATION
   A directory without a usable $INDEX_ALLOCATION hangs on its first
   lookup. The task waits for an mft record lock that it already holds.
   It needs one changed byte in a crafted image.

2. ntfs: open the index allocation before reading or writing an index block
   NULL pointer dereference in ntfs_ib_write() on link() when the lookup
   ended in the index root. This is not the path fixed by 9365c4a1357e.
   It needs one changed byte in a crafted image.

3. ntfs: open a named $DATA stream by name when making room in a record
   WARN_ON() in ntfs_attr_make_non_resident(). This one does not need a
   damaged volume: a file with an alternate data stream and a full mft
   record is enough.

All three need an image to be mounted, so a crafted image, not a remote
attacker. I can send the images (about 380 KB each, compressed) if they
are useful.


Wahid Khan (3):
  ntfs: do not read an index block outside $INDEX_ALLOCATION
  ntfs: open the index allocation before reading or writing an index
    block
  ntfs: open a named $DATA stream by name when making room in a record

 fs/ntfs/attrib.c |  2 +-
 fs/ntfs/dir.c    | 14 ++++++++++++++
 fs/ntfs/index.c  | 17 +++++++++++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)

-- 
2.53.0