fs/ntfs3: fix slab-out-of-bounds write in ntfs_create_inode

ntfs_create_inode() sizes the non-resident reparse run list as record_size - offset - SIZEOF_NONRESIDENT, then sets the attribute size to SIZEOF_NONRESIDENT + ALIGN(run_pack(), 8). It does not reserve space for the trailing ATTR_END, so a maximally packed run list places that 4-byte sentinel just past the allocated MFT record.

BUG: KASAN: slab-out-of-bounds in ntfs_create_inode+0x4390/0x5220
  ntfs_create_inode+0x4390/0x5220 fs/ntfs3/inode.c:1796
  ntfs_symlink+0x108/0x170 fs/ntfs3/namei.c:224
  vfs_symlink+0x137/0x420
  filename_symlinkat+0x326/0x460
  __x64_sys_symlink+0x79/0xb0

After packing the run list, check that the 8-byte ATTR_END slot still fits in the MFT record. Return -EINVAL if the aligned run list would place it past the buffer.

---
 fs/ntfs3/inode.c | 5 +++++
 1 file changed, 5 insertions(+)

index 56b4f6469a28..d6e4b4b3154d 100644
@@ -1769,6 +1769,11 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,
 			}
 
 			asize = SIZEOF_NONRESIDENT + ALIGN(err, 8);
+			if (asize + PtrOffset(rec, attr) + 8 >
+			    sbi->record_size) {
+				err = -EINVAL;
+				goto out5;
+			}
 			/* Write non resident data. */
 			err = ntfs_sb_write_run(sbi, &ni->file.run, 0, rp,
 						nsize, 0);

base-commit: cee9395acd8043be0644b25c34bfa86623f2b935

2.55.0