[PATCH] fs/ntfs3: Fix out-of-bounds write in resident insert range

[PATCH] fs/ntfs3: Fix out-of-bounds write in resident insert range

[Bruno Produit]

From: Kyle Zeng <kylebot@openai.com>

attr_insert_range() grows a resident value before shifting data at and
after the insertion offset.  The current copy instead moves @bytes bytes
from the start of the value, so both its source offset and length are
wrong.

For example, inserting 2048 bytes at offset 512 in a 513-byte resident
value copies 2048 bytes to data + 2048 even though the tail is only one
byte long.  The resulting destination can extend beyond the MFT record
allocation.

Move the original tail from the insertion offset to its new location,
then clear the inserted range.

Fixes: aa30eccb24e5 ("fs/ntfs3: Fallocate (FALLOC_FL_INSERT_RANGE) implementation")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
---
 fs/ntfs3/attrib.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index b1c315206..4bd758133 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -2610,8 +2610,9 @@ int attr_insert_range(struct ntfs_inode *ni, u64 vbo, u64 bytes)
 			char *data = Add2Ptr(attr_b,
 					     le16_to_cpu(attr_b->res.data_off));
 
-			memmove(data + bytes, data, bytes);
-			memset(data, 0, bytes);
+			memmove(data + vbo + bytes, data + vbo,
+				data_size - vbo);
+			memset(data + vbo, 0, bytes);
 			goto done;
 		}
 
-- 
2.53.0