ntfs kernel module

[Stephen J. Smoogen]

On Tue, 26 Oct 2004 16:53:47 -0400 (EDT), Robert P. J. Day
<rpjday at mindspring.com> wrote:
> On Tue, 26 Oct 2004, Alexandre Oliva wrote:
> 
> > On Oct 26, 2004, Alexandre Strube <surak at casa.surak.eti.br> wrote:
> >
> > > The ntfs module used in other distributions is mainly read-only... how
> > > can this corrupt a file system?
> >
> > All it takes is a bit of incorrect memory management in the kernel.
> > As soon as you corrupt kernel data structures, all bets are off.  Say,
> > double-free of a pointer to an ntfs read-only buffer could corrupt
> > whatever data structure that buffer was being reused for after the
> > first free.
> 
> i've always wondered about this -- i still don't see how that could
> corrupt the NTFS structure *on* *disk*.  sure, it's entirely possible
> that the cached NTFS info in RAM might get screwed, you might lose the
> ability to *read* files from the hard drive.  but i don't see how that
> equates to actually *damaging* the contents on the hard drive.
> 
> if i mount a filesystem read-only, i expect it never to be altered.
> doesn't NTFS use the same VFS layer as everyone else?  shouldn't
> "readonly" mounting be respected by that layer?
> 

When I worked at Red Hat support... we were able to duplicate the
corruption on read-only. This would have been 1999 or so. I remember
retrying it around 2001 and also having to reinstall my Windows 2000
stuff after doing a very large grep. The only thing that I could
figure out at that time was that something like the journal wasnt
being mounted read-only and that corrupted the disk... but I am so far
out of my league beyond.. hmm it broke.

There were issues that Microsoft said they had patents in NTFS in
various news articles but no-one in support could correlate what
patents they were saying and how 'enforceable they were'. This is all
before July 2001. After that.. I have no idea what RH wanted to do.


-- 
Stephen J Smoogen.
CSIRT/Linux System Administrator