[PATCH 2/2] ntfs3: validate fname size against resident data in ni_remove_name

[KRISH JAIN]

In ni_remove_name(), fname_full_size() computes the copy length from
the untrusted on-disk name_len field, which can be up to 255 (yielding
576 bytes). If name_len is larger than the attribute's actual resident
data size, the subsequent memcpy reads past the end of the attribute
buffer.

Add a check that fname_full_size() does not exceed the attribute's
res.data_size before performing the copy.

Fixes: 8d3ae59288f1 ("Linux 7.2")
Signed-off-by: KRISH JAIN <k3rn3lbr3ach3r@xxxxxxxxx>
Assisted-by: Claude:Opus4.6
---
 fs/ntfs3/frecord.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 2b49bc077..42627a5f2 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -2653,6 +2653,10 @@ int ni_remove_name(struct ntfs_inode *dir_ni, struct=
 ntfs_inode *ni,
      fname =3D ni_fname_type(ni, name_type, &mi, &le);
      if (fname) {
              u16 de2_key_size =3D fname_full_size(fname);
+             struct ATTRIB *attr =3D attr_from_name(fname);
+
+             if (de2_key_size > le32_to_cpu(attr->res.data_size))
+                     return -EINVAL;

              *de2 =3D Add2Ptr(de, 1024);
              (*de2)->key_size =3D cpu_to_le16(de2_key_size);
--
2.53.0

---