DragonFlyBSD Kernel Audit
DF-0786 / panic.txt
← back to finding ↓ download raw
=== DF-0786: Live NTFS lookup panic (pre-existing lockmgr bug, NOT the off-by-one) ===

When attempting to trigger the off-by-one via stat /mnt/ntfs/a:AAAAAAAA on a
mounted NTFS volume, the DragonFly NTFS lookup path panics with a lockmgr error
BEFORE reaching the vulnerable ntfs_ntlookupattr() code:

panic: lockmgr: locking against myself
lockmgr_exclusive() at lockmgr_exclusive+0x3e0 0xffffffff80647f30 
lockmgr_exclusive() at lockmgr_exclusive+0x3e0 0xffffffff80647f30 
ntfs_ntlookupfile() at ntfs_ntlookupfile+0x57 0xffffffff82604c27 
ntfs_lookup() at ntfs_lookup+0x63 0xffffffff82601e13 
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

This is a pre-existing DragonFly NTFS locking bug (ntfs_ntget tries to
exclusively lock ip->i_lock when it is already held by the current thread).
It affects ALL file lookups on mounted NTFS volumes in this kernel version,
not just the off-by-one trigger path. The off-by-one at ntfs_subr.c:826-828
is confirmed via source analysis and the guard-page harness instead.