ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize().
When the attribute is in an extent record, ctx->mrec points to the extent
but the function receives the base record pointer m, causing incorrect
size calculations in memmove.

Fix by passing ctx->mrec (the actual MFT record containing the attribute)
instead of m (the base MFT record) to ntfs_attr_record_resize().

Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 fs/ntfs/ea.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index 44252f2c2ca6..534f7efaf128 100644
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -740,7 +740,7 @@ static int ntfs_new_attr_flags(struct ntfs_inode *ni, __le32 fattr)
 			memmove((u8 *)a + mp_ofs, (u8 *)a + old_mp_ofs, mp_size);
 	}
 
-	err = ntfs_attr_record_resize(m, a, arec_size);
+	err = ntfs_attr_record_resize(ctx->mrec, a, arec_size);
 	if (unlikely(err))
 		goto err_out;
 
-- 
2.25.1

On Mon, Aug 24, 2026 at 2:41 PM Hongling Zeng <zenghongling@kylinos.cn> wrote:
>
> ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize().
> When the attribute is in an extent record, ctx->mrec points to the extent
> but the function receives the base record pointer m, causing incorrect
> size calculations in memmove.
>
> Fix by passing ctx->mrec (the actual MFT record containing the attribute)
> instead of m (the base MFT record) to ntfs_attr_record_resize().
>
> Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Applied it to #ntfs-next.
Thanks!

2026년 8월 24일 (월) 오후 2:41, Hongling Zeng <zenghongling@kylinos.cn>님이 작성:
>
> ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize().
> When the attribute is in an extent record, ctx->mrec points to the extent
> but the function receives the base record pointer m, causing incorrect
> size calculations in memmove.
>
> Fix by passing ctx->mrec (the actual MFT record containing the attribute)
> instead of m (the base MFT record) to ntfs_attr_record_resize().
>
> Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>

Looks good to me.

Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>

> ---
>  fs/ntfs/ea.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
> index 44252f2c2ca6..534f7efaf128 100644
> --- a/fs/ntfs/ea.c
> +++ b/fs/ntfs/ea.c
> @@ -740,7 +740,7 @@ static int ntfs_new_attr_flags(struct ntfs_inode *ni, __le32 fattr)
>                         memmove((u8 *)a + mp_ofs, (u8 *)a + old_mp_ofs, mp_size);
>         }
>
> -       err = ntfs_attr_record_resize(m, a, arec_size);
> +       err = ntfs_attr_record_resize(ctx->mrec, a, arec_size);
>         if (unlikely(err))
>                 goto err_out;
>
> --
> 2.25.1
>


-- 
Thanks,
Hyunchul