From 10993e525b1ee81cbe02a8ca7d0005712f6b3d82 Mon Sep 17 00:00:00 2001
From: Hyunchul Lee <hyc.lee@gmail.com>
Date: Mon, 9 Mar 2026 16:06:06 +0900
Subject: [PATCH] ntfs: check $EA query-length in ntfs_ea_get

if ea_info_qlen exceeds all_ea_size, OOB can happen.

Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---
 fs/ntfs/ea.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index d479bf3608c8..115e3c5552a3 100644
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -136,6 +136,11 @@ static int ntfs_get_ea(struct inode *inode, const char *name, size_t name_len,
 	if (!ea_buf)
 		return -ENODATA;
 
+	if (ea_info_qlen > all_ea_size) {
+		err = -EIO;
+		goto free_ea_buf;
+	}
+
 	err = ntfs_ea_lookup(ea_buf, ea_info_qlen, name, name_len, &ea_off,
 			&ea_size);
 	if (!err) {