[PATCH 0/2] ntfs: enforce the encrypted-file policy on the read paths

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>

EFS-encrypted attributes are refused with -EOPNOTSUPP in exactly one
place, ntfs_read_folio(), because decryption is not implemented.  Two
read paths get there without passing that test and return the raw
on-disk ciphertext instead, so the same read returns either ciphertext
or -EOPNOTSUPP depending on which path serves it.

Patch 1 is readahead, which marks the folios uptodate so ->read_folio
is never called.  read(), mmap(), splice() and fadvise() all populate
the page cache this way, so one test closes all four.

Patch 2 is direct I/O, which bypasses the page cache entirely and has
no such backstop.

Both commits are in v7.1.  I have not added Cc: stable; returning
ciphertext rather than an error is a correctness bug but not a
privilege boundary crossing, so that call is better made by the
maintainers.

Found by reading the code.  I have no EFS-encrypted NTFS volume, so
there is no reproducer; the paths were traced in the source.

Zhan Xusheng (2):
  ntfs: do not read ahead encrypted files
  ntfs: reject direct I/O reads of encrypted files

 fs/ntfs/aops.c | 7 ++++---
 fs/ntfs/file.c | 4 ++--
 2 files changed, 6 insertions(+), 5 deletions(-)


base-commit: d6d3455d8751854e0d1820f14184682e23ac4475
-- 
2.43.0