Re: [PATCH] ntfs: fix memmove overlap in ntfs_new_attr_flags

[Hyunchul Lee]

2026년 8월 25일 (화) 오후 3:36, Hongling Zeng <zhongling0719@xxxxxxx>님이 작성:
>
>
> 在 2026年08月25日 13:45, Hyunchul Lee 写道:
> > Hi Hongling,
> >
> > 2026년 8월 24일 (월) 오후 4:59, Hongling Zeng <zenghongling@xxxxxxxxxx>님이 작성:
> >> When the record shrinks while the payload offsets increase (e.g., enabling
> >> compression reduces padding, making arec_size < old_arec_size, but the header
> >> grows by 8 bytes), moving the name first can overwrite the old mapping_pairs
> >> before they are copied. Move mapping_pairs first in this case.
> > Can this situation occur even when
> > it is not a crafted image?
> Hi Hyunchul
>
>    Yes. This can occur during normal operations when modifying
> system.ntfs_attrib
>    on a file with a named non-resident attribute. The header grows
> (adding the
>    compressed_size field) while the total record shrinks (reduced padding),
>    causing name_ofs and mp_ofs to increase and creating the memmove overlap.
>
>    No crafted image is required - a valid NTFS filesystem with the right
>    attribute layout will trigger this path.

What I am wondering was whether there had been
cases where such padding existed.
I has been considering where we should guard
against that case.

This patch looks good to me.

Reviewed-by: Hyunchul Lee <hyc.lee@xxxxxxxxx>