From: Hyunchul Lee <hyc.lee@gmail.com>
Date: Mon, 9 Mar 2026 04:06:51 +0000 (+0900)
Subject: ntfs: validate WSL EA payload sizes
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a5325419e9fb086f79334723a54481336dc9d561;p=thirdparty%2Fkernel%2Flinux.git

ntfs: validate WSL EA payload sizes

Enforce the exact-size reads for $LXUID, $LXGID, $LXMOD, $LXDEV.

Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---

diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index 386eb0c5f303d..d479bf3608c85 100644
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -365,6 +365,8 @@ int ntfs_ea_get_wsl_inode(struct inode *inode, dev_t *rdevp, unsigned int flags)
 				sizeof(v));
 		if (err < 0)
 			return err;
+		if (err != sizeof(v))
+			return -EIO;
 		i_uid_write(inode, le32_to_cpu(v));
 	}
 
@@ -374,12 +376,14 @@ int ntfs_ea_get_wsl_inode(struct inode *inode, dev_t *rdevp, unsigned int flags)
 				sizeof(v));
 		if (err < 0)
 			return err;
+		if (err != sizeof(v))
+			return -EIO;
 		i_gid_write(inode, le32_to_cpu(v));
 	}
 
 	/* Load mode to lxmod EA */
 	err = ntfs_get_ea(inode, "$LXMOD", sizeof("$LXMOD") - 1, &v, sizeof(v));
-	if (err > 0) {
+	if (err == sizeof(v)) {
 		inode->i_mode = le32_to_cpu(v);
 	} else {
 		/* Everyone gets all permissions. */
@@ -388,7 +392,7 @@ int ntfs_ea_get_wsl_inode(struct inode *inode, dev_t *rdevp, unsigned int flags)
 
 	/* Load mode to lxdev EA */
 	err = ntfs_get_ea(inode, "$LXDEV", sizeof("$LXDEV") - 1, &v, sizeof(v));
-	if (err > 0)
+	if (err == sizeof(v))
 		*rdevp = le32_to_cpu(v);
 	err = 0;