> If the "nocase" mount option ntfs3 uses custom hash and dentry compare
> functions. Both access ntfs3 superblock private information in rcu
> pathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any
> rcu delay. A lookup that's still inside the filesystem when the last
> reference to the mount is dropped causes a UAF. With a pathwalk held up
> in ntfs_d_hash() while the last reference to the mount goes away:
>
> BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940
> Read of size 8 at addr ff1100010453c850 by task walker/99
> Call Trace:
> <TASK>
> ntfs_nls_to_utf16+0x752/0x940
> ntfs_d_hash+0x22b/0x500
> link_path_walk+0x11ad/0x1d30
> path_lookupat+0x63/0xb00
> [ ... ]
> holding the lock on the same cpu.
>
> Fixes: a3a956c78efa ("fs/ntfs3: Add option "nocase"")
> Cc: [email protected]
> Signed-off-by: Christian Brauner (Amutable) <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=7
