From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=35.157.23.187 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794388507; b=irKD1ebFlYmtRcN6KpXfa0cErOcthyDE+yI6vJ58y9M34Q3/H4+JW4sVoOz7TQAjaR4K lViOKY18Ef0nLSTUwDXRdeEJgkmpzEd7+obJCJQYOVwtxXq1yqUcEb3ImGk9Vc+WHp3B5 SYm/CwuMmMYMD671ONCpOfrwe7LWUMDT//zs3axILfLJiCD7A1lsXmR0ak1Dm8U3VeQzt vIm7b9dTIVisXO2DJ8gUXq6pE/Drjib80OhrF4odekWdpx090gsLcN1UwDxjrJ5f9m3I7 NAbds3GDoyvdPA9hTqPOdQcaCFIYq3/SWdoBH6L+dXgzjB9YEwlcITvtmE2JRixNCaA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794388507; h=DMARC-Filter:Received:Received:DKIM-Signature:Received:Message-ID: Date:MIME-Version:User-Agent:Subject:To:CC:References: Content-Language:From:In-Reply-To:Content-Type: Content-Transfer-Encoding:X-Originating-IP:X-ClientProxiedBy; bh=0+CgbwybaiTL/onVXenjL9lJTFScjyLVLl+Z42tjuTM=; b=1PTJmxwlKYoipqVTxjWJgAjbZudt8hF6KOPuZGQ4KPFVR9cZmsNpEMl/84pivckok1hC yB1AVRnXp6uRV9G+3AtHhuiIgzSNR98MxSXsl4Ew9C7/SqL7PwDmwjNciK5ReaC8jXSfn PlevgRuYaeF+svKpz0f4kL5X81OpGcH9kExidhfpuQkstFOKMT9P2al5harW+d5QkeJ95 gA9TuJwsn8R5NTMF/sYTN6JXILZQhkiRBu4d3zJ+KjlB+s0YrHq3Eruygi1jD09In2quh jsB/8KcqGOa2Y08QbSGMQFChmHJi6wRU7R78F36OvEDMhMo9jsattnvfIebHyaWtJLA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=paragon-software.com; spf=pass smtp.mailfrom=paragon-software.com; dkim=pass header.d=paragon-software.com header.i=@paragon-software.com header.a=rsa-sha256 header.s=mail header.b=nFjuETd7; arc=none smtp.remote-ip=35.157.23.187 Received: from relayaws-01.paragon-software.com (relayaws-01.paragon-software.com [35.157.23.187]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8223C60A2601 for ; Wed, 11 Nov 2026 09:15:06 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 8223C60A2601 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=paragon-software.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=paragon-software.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=paragon-software.com header.i=@paragon-software.com header.a=rsa-sha256 header.s=mail header.b=nFjuETd7 Received: from relayfre-01.paragon-software.com (relayfre-01.paragon-software.com [176.12.100.13]) by relayaws-01.paragon-software.com (Postfix) with ESMTPS id 5AD021D28; Wed, 11 Nov 2026 09:15:49 +0000 (UTC) Authentication-Results: relayaws-01.paragon-software.com; dkim=pass (1024-bit key; unprotected) header.d=paragon-software.com header.i=@paragon-software.com header.b=nFjuETd7; dkim-atps=neutral Received: from dlg2.mail.paragon-software.com (vdlg-exch-02.paragon-software.com [172.30.1.105]) by relayfre-01.paragon-software.com (Postfix) with ESMTPS id 8F800238A; Wed, 11 Nov 2026 09:15:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paragon-software.com; s=mail; t=1794388504; bh=0+CgbwybaiTL/onVXenjL9lJTFScjyLVLl+Z42tjuTM=; h=Date:Subject:To:CC:References:From:In-Reply-To; b=nFjuETd7yrUkbrpX4qd5bLhlioecIpVTSBW1RNvpZi4jA5axmrmbtwBmm50Hs5nxf SNLm3S52gC8fIQqK6ru7LuCki3plRrihFi/evQ1OP750h+eZF2aOVdkStmGRvjW58C f+zY1mymUvYERypzM/qF/A08txJWxpqOwp03P5cs= Received: from [192.168.95.128] (172.30.20.190) by vdlg-exch-02.paragon-software.com (172.30.1.105) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.7; Wed, 11 Nov 2026 12:15:03 +0300 Message-ID: Date: Wed, 11 Nov 2026 10:15:01 +0100 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] ntfs3: Update only the member values without replacing the opts pointer To: Edward Adam Davis , CC: , , References: <6a778cc0.01d0871a.3a0d52.006c.GAE@google.com> Content-Language: en-US From: Konstantin Komarov In-Reply-To: Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit X-ClientProxiedBy: vdlg-exch-02.paragon-software.com (172.30.1.105) To vdlg-exch-02.paragon-software.com (172.30.1.105) On 8/9/26 08:07, Edward Adam Davis wrote: > There is a potential race condition when accessing options during remount > and read operations. This would trigger a uaf [1]. > > CPU0: remount CPU1: read options > ================================== ================== > do_remount() > reconfigure_super() > ntfs_fs_reconfigure() > sbi->options = fc->fs_private > put_fs_context() > ntfs_fs_free() > put_mount_options() ntfs_show_options() > kfree(sbi->options) opts = sbi->options > opts->dmask //trigger uaf > > The fix involves not updating the sbi->options pointer during > reconfiguration, but instead using fc->fs_private to update the > corresponding member values. > > [1] > BUG: KASAN: slab-use-after-free in ntfs_show_options+0x656/0x800 fs/ntfs3/super.c:762 > Call Trace: > ntfs_show_options+0x656/0x800 fs/ntfs3/super.c:762 > show_vfsmnt+0x637/0x780 fs/proc_namespace.c:129 > seq_read_iter+0x8d6/0xcb0 fs/seq_file.c:273 > new_sync_read fs/read_write.c:493 [inline] > vfs_read+0x59e/0xa90 fs/read_write.c:574 > > Allocated by task 6027: > ntfs_init_fs_context+0x55/0x570 fs/ntfs3/super.c:1862 > alloc_fs_context+0x9a3/0xd00 fs/fs_context.c:295 > do_remount fs/namespace.c:3392 [inline] > path_mount+0xc5e/0x1040 fs/namespace.c:4153 > do_mount fs/namespace.c:4174 [inline] > > Freed by task 6026: > kfree+0x1c5/0x6c0 mm/slub.c:6692 > put_fs_context+0x123/0xb00 fs/fs_context.c:498 > do_remount fs/namespace.c:3419 [inline] > path_mount+0xef9/0x1040 fs/namespace.c:4153 > do_mount fs/namespace.c:4174 [inline] > > Fixes: cd39981fb92a ("fs/ntfs3: Fix double free on remount") > Reported-by: syzbot+4c22f022eb39c86b9d19@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=4c22f022eb39c86b9d19 > Tested-by: syzbot+4c22f022eb39c86b9d19@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis > --- > fs/ntfs3/super.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c > index 3305fe406cb2..58540491e68b 100644 > --- a/fs/ntfs3/super.c > +++ b/fs/ntfs3/super.c > @@ -461,7 +461,7 @@ static int ntfs_fs_reconfigure(struct fs_context *fc) > } > > sync_filesystem(sb); > - swap(sbi->options, fc->fs_private); > + memcpy(sbi->options, fc->fs_private, sizeof(*sbi->options)); > > return 0; > } Hello, Sorry for the delay. In the meantime commit 56c3824de56b ("ntfs3: free replaced mount options after a grace period") went upstream. It addresses the same root cause: sbi->options is replaced and the old options are now freed after an RCU grace period instead of immediately. Since that approach is already merged, I won't apply your patch. Thanks for the work and the report. Regards, Konstantin