diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index ce7253b3f549..5f535d45111b 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1040,6 +1040,13 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, ret = -EFSCORRUPTED; goto out; } + if (overflows_type(ref_count + ref_change, u64)) { + ext4_error_inode(ea_inode, __func__, __LINE__, 0, + "EA inode %lu ref overflows: ref_count=%lld ref_change=%d", + ea_inode->i_ino, ref_count, ref_change); + ret = -EFSCORRUPTED; + goto out; + } ref_count += ref_change; ext4_xattr_inode_set_ref(ea_inode, ref_count);