Skip to contentSkip to conversation

huge VCN in ntfs can result in a kernel page fault

DISCUSSION [email protected] 2 participants 3 messages Oct 27 – Oct 28 NTFS filesystem

lore
Share & tools
lore

[email protected]

author
#0 lore raw

If the 64-bit VCN in an index entry would have the the high bit set if shifted left by icx->vcn_size_bits, ntfs_index_walk_down() will pass that vcn to ntfs_ib_read(), which shifts it left and passes it (via pos) to ntfs_inode_attr_pread(), which checks s64 pos for too big but not too small:

        if (pos > isize) {
                mutex_unlock(&mrec_ni->mrec_lock);
                return -EINVAL;
        }

and then passes a bad pointer to memcpy() (line 3801 of ntfs/inode.c):

                memcpy(buf, (u8 *)attr + pos, count);
# wget http://www.rtmrtm.org/rtm/ntfs23g.img.gz
# gunzip ntfs23g.img.gz 
# mount -t ntfs -o loop,rw ntfs23g.img /mnt
# ls -l /mnt
ntfs: (device loop0): ntfs_lookup_inode_by_name(): Corrupt directory.  Aborting lookup.
ntfs: (device loop0): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys.
ntfs: (device loop0): load_system_files(): Failed to determine if Windows is hibernated.  Mounting read-only.  Run chkdsk.
Oops: general protection fault, probably for non-canonical address 0x7fffc039131f1c50: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
CPU: 4 UID: 0 PID: 1475 Comm: ls Not tainted 7.3.0-16472-gd135ab453a74 #46 PREEMPT(full)
Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021
RIP: 0010:memcpy_orig+0x16/0x140
Code: 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 f8 48 83 fa 20 72 7e 40 38 fe 7c 35 48 83 ea 20 48 83 ea 20 <4c> 8b 06 4c 8b 4e 08 4c 8b 56 10 4c 8b 5e 18 48 8d 76 20 4c 89 07
RSP: 0018:ffffc90000b27ce8 EFLAGS: 00010206
RAX: ffff888104869000 RBX: 800037b810010000 RCX: ffff8881056fa140
RDX: 0000000000000fc0 RSI: 7fffc039131f1c50 RDI: ffff888104869000
RBP: ffffc90000b27d48 R08: ffff8881056fa140 R09: 0000000000000000
R10: 0000000000000018 R11: ffffffff817f16b6 R12: 0000000000000000
R13: ffff888104869000 R14: ffff8881056fa140 R15: 0000000000001000
FS:  00007fe46c7a5800(0000) GS:ffff8884aa47e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005646e478fb68 CR3: 0000000108cd4001 CR4: 00000000003706f0
Call Trace:
 <TASK>
 ? ntfs_inode_attr_pread+0x33c/0x410
 ntfs_ib_read+0x5f/0xf0
 ntfs_index_walk_down+0x76/0x120
 ntfs_readdir+0x8ae/0xba0
 ? selinux_file_permission+0x127/0x190
 iterate_dir+0x80/0x190
 __x64_sys_getdents64+0x77/0x110
 ? __pfx_filldir64+0x10/0x10
 x64_sys_call+0x96b/0x2220
 do_syscall_64+0xdd/0x4a0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Robert Morris
[email protected]