From: Hyunchul Lee <hyc.lee@gmail.com>
Date: Mon, 9 Mar 2026 07:06:06 +0000 (+0900)
Subject: ntfs: check $EA query-length in ntfs_ea_get
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=10993e525b1ee81cbe02a8ca7d0005712f6b3d82;p=thirdparty%2Fkernel%2Flinux.git

ntfs: check $EA query-length in ntfs_ea_get

if ea_info_qlen exceeds all_ea_size, OOB can happen.

Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---

diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index d479bf3608c85..115e3c5552a33 100644
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -136,6 +136,11 @@ static int ntfs_get_ea(struct inode *inode, const char *name, size_t name_len,
 	if (!ea_buf)
 		return -ENODATA;
 
+	if (ea_info_qlen > all_ea_size) {
+		err = -EIO;
+		goto free_ea_buf;
+	}
+
 	err = ntfs_ea_lookup(ea_buf, ea_info_qlen, name, name_len, &ea_off,
 			&ea_size);
 	if (!err) {