When reading an MFT record attribute of type ATTR_NAME, ntfs_read_mft() validates only the fixed FILE_NAME header (SIZEOF_ATTRIBUTE_FILENAME) against the resident attribute size, but never bounds the variable name length. A crafted record with fname->name_len up to 255 and a minimal resident size then makes ntfs_cmp_names_cpu() read fname->name past the end of the MFT-record buffer (KASAN: slab-out-of-bounds, read of size 2), reachable from a mounted crafted NTFS image by a stat() of the name. The directory enumeration path (ntfs_dir_emit) already bounds the name against the entry size; apply the same bound here using the existing fname_full_size() helper. Signed-off-by: Marouane El Moufid --- fs/ntfs3/inode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -202,6 +202,8 @@ names += 1; fname = Add2Ptr(attr, roff); + if (fname_full_size(fname) > rsize) + goto out; if (fname->type == FILE_NAME_DOS) goto next_attr;