[PATCH 2/5] fs: ext4: reject superblocks with zero inodesz, gdsize or inodes_per_group

[Sascha Hauer]

The superblock fields inode_size, descriptor_size, and inodes_per_group
are read from disk and used as divisors without validation:

  - inodesz == 0: division by zero in ext4fs_read_inode()
  - gdsize == 0: division by zero in ext4fs_blockgroup()
  - inodes_per_group == 0: division by zero in ext4fs_read_inode()

All three are trivially triggered by a crafted filesystem image.

Validate these fields are non-zero at mount time and reject the
filesystem if they aren't.

Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply at anthropic.com>
---
 fs/ext4/ext4_common.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
index 094293a069..5d252b4a2c 100644
--- a/fs/ext4/ext4_common.c
+++ b/fs/ext4/ext4_common.c
@@ -541,6 +541,15 @@ int ext4fs_mount(struct ext_filesystem *fs)
 	      le32_to_cpu(data->sblock.revision_level),
 	      fs->inodesz, fs->gdsize);
 
+	if (!fs->inodesz || !fs->gdsize ||
+	    !le32_to_cpu(data->sblock.inodes_per_group)) {
+		dev_err(fs->dev, "invalid superblock: inodesz=%u gdsize=%u inodes_per_group=%u\n",
+			fs->inodesz, fs->gdsize,
+			le32_to_cpu(data->sblock.inodes_per_group));
+		ret = -EINVAL;
+		goto fail;
+	}
+
 	data->diropen.data = data;
 	data->diropen.ino = 2;
 	data->diropen.inode_read = 1;

-- 
2.47.3