[PATCH] ntfs3: fix buffer overflow in CreateAttribute validation

[Hongling Zeng]

In the CreateAttribute action, the validation checks whether dlen
fits within the available MFT record space, but the actual memcpy
uses asize (the attribute size from the log record) as the copy length.

A malicious NTFS journal record can set a small dlen to pass the
validation while setting a large asize that exceeds the MFT record
buffer size, causing a buffer overflow when memcpy copies asize bytes
into the destination buffer.

The validation must use the same size that is later passed to memcpy().

Fix this by using asize in the bounds check instead of dlen, since
asize is the actual length used by memcpy. The source buffer boundary
is already validated by the existing check:
      Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len)

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
---
 fs/ntfs3/fslog.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 3440212ecb12..294d7a2f4e2c 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3288,7 +3288,7 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
 		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
 		    !IS_ALIGNED(asize, 8) ||
 		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
-		    dlen > record_size - used) {
+		    asize > record_size - used) {
 			goto dirty_vol;
 		}
 
-- 
2.25.1