[PATCH v2] ntfs3: fix buffer overflow in CreateAttribute validation

In the CreateAttribute action, the validation checks whether dlen
fits within the available MFT record space, but the actual memcpy
uses asize (the attribute size from the log record) as the copy length.

A malicious NTFS journal record can set a small dlen to pass the
validation while setting a large asize that exceeds the MFT record
buffer size, causing a buffer overflow when memcpy copies asize bytes
into the destination buffer.

The validation must use the same size that is later passed to memcpy().

Fix this by using asize in the bounds check instead of dlen, since
asize is the actual length used by memcpy. The source buffer boundary
is already validated by the existing check:
      Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len)

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: [email protected]
Signed-off-by: Hongling Zeng <[email protected]>
---
Change in v2:
 Also fix the lower bound check to use asize instead of dlen. A malicious
 log record with dlen >= 24 (passing dlen < SIZE_OF_RESIDENT check) but
 asize < 24 could allocate insufficient memory and trigger OOB accesses
 in subsequent operations.
---
 fs/ntfs3/fslog.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 3440212ecb12..e15f7621863e 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3285,10 +3285,10 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
 		asize = le32_to_cpu(attr2->size);
 		used = le32_to_cpu(rec->used);
 
-		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
+		if (!check_if_attr(rec, lrh) || asize < SIZEOF_RESIDENT ||
 		    !IS_ALIGNED(asize, 8) ||
 		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
-		    dlen > record_size - used) {
+		    asize > record_size - used) {
 			goto dirty_vol;
 		}
 
-- 
2.25.1