From: Kyle Zeng attr_insert_range() grows a resident value before shifting data at and after the insertion offset. The current copy instead moves @bytes bytes from the start of the value, so both its source offset and length are wrong. For example, inserting 2048 bytes at offset 512 in a 513-byte resident value copies 2048 bytes to data + 2048 even though the tail is only one byte long. The resulting destination can extend beyond the MFT record allocation. Move the original tail from the insertion offset to its new location, then clear the inserted range. Fixes: aa30eccb24e5 ("fs/ntfs3: Fallocate (FALLOC_FL_INSERT_RANGE) implementation") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Kyle Zeng Signed-off-by: Bruno Produit --- fs/ntfs3/attrib.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c index b1c315206..4bd758133 100644 --- a/fs/ntfs3/attrib.c +++ b/fs/ntfs3/attrib.c @@ -2610,8 +2610,9 @@ int attr_insert_range(struct ntfs_inode *ni, u64 vbo, u64 bytes) char *data = Add2Ptr(attr_b, le16_to_cpu(attr_b->res.data_off)); - memmove(data + bytes, data, bytes); - memset(data, 0, bytes); + memmove(data + vbo + bytes, data + vbo, + data_size - vbo); + memset(data + vbo, 0, bytes); goto done; } -- 2.53.0