6.1-stable patches

added patches:
	ntfs3-reject-direct-userspace-writes-to-reserved-lx-xattrs.patch

diff --git a/queue-6.1/ntfs3-reject-direct-userspace-writes-to-reserved-lx-xattrs.patch b/queue-6.1/ntfs3-reject-direct-userspace-writes-to-reserved-lx-xattrs.patch
new file mode 100644 (file)
index 0000000..b454e08
--- /dev/null
+++ b/queue-6.1/ntfs3-reject-direct-userspace-writes-to-reserved-lx-xattrs.patch
@@ -0,0 +1,58 @@
+From 5b08dccecf825cbf905f348bc6ccb497507e28e2 Mon Sep 17 00:00:00 2001
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Date: Wed, 10 Jun 2026 12:31:01 +0200
+Subject: ntfs3: reject direct userspace writes to reserved $LX* xattrs
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+commit 5b08dccecf825cbf905f348bc6ccb497507e28e2 upstream.
+
+NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL
+permission metadata and reloads them into i_uid, i_gid and i_mode
+from ntfs_get_wsl_perm().
+
+Because the empty-prefix xattr handler also lets file owners call
+setxattr() on these names directly, an unprivileged writer on a
+writable ntfs3 mount can plant root ownership and S_ISUID on their own
+file and gain euid 0 after inode reload.
+
+Reject direct userspace writes to the reserved $LX* names. Internal
+ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm()
+writes them via ntfs_set_ea() directly.
+
+Signed-off-by: Zhen Yan <sdjasjbuaa@gmail.com>
+[almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ntfs3/xattr.c |   12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/fs/ntfs3/xattr.c
++++ b/fs/ntfs3/xattr.c
+@@ -846,6 +846,12 @@ out:
+       return err;
+ }
+ 
++static bool ntfs_is_reserved_lxattr(const char *name)
++{
++      return !strcmp(name, "$LXUID") || !strcmp(name, "$LXGID") ||
++             !strcmp(name, "$LXMOD") || !strcmp(name, "$LXDEV");
++}
++
+ /*
+  * ntfs_setxattr - inode_operations::setxattr
+  */
+@@ -951,6 +957,12 @@ set_new_fa:
+               goto out;
+       }
+ 
++      /* Do not allow non privileged users to change $LXUID/$LXGID... */
++      if (ntfs_is_reserved_lxattr(name) && !capable(CAP_SYS_ADMIN)) {
++              err = -EPERM;
++              goto out;
++      }
++
+       /* Deal with NTFS extended attribute. */
+       err = ntfs_set_ea(inode, name, name_len, value, size, flags, 0);
+ 

diff --git a/queue-6.1/series b/queue-6.1/series
index 8b6c0b06e8327873959a0f3d3a16c8b46dcd8c6f..93c97e5702b3983d9ce2af3c6d14eb96b7e65e04 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -72,3 +72,4 @@ batman-adv-tt-track-roam-count-per-vid.patch
 batman-adv-dat-prevent-false-sharing-between-vlans.patch
 batman-adv-tvlv-enforce-2-byte-alignment.patch
 batman-adv-tvlv-avoid-race-of-cifsnotfound-handler-s.patch
+ntfs3-reject-direct-userspace-writes-to-reserved-lx-xattrs.patch