[PATCH 1/5] fs: ext4: validate log2_block_size from superblock at mount

[Sascha Hauer]

The superblock's log2_block_size field is read from disk and used
throughout the ext4 code without validation. EXT2_BLOCK_SIZE() computes
1 << (log2_block_size + 10), so a crafted value of 22 or larger causes
undefined behavior from shifting an int by >= 32 bits.

This leads to wrong allocation sizes for indirect block buffers and
enables downstream buffer overflows in every function that reads
block-sized data.

Validate that log2_block_size does not exceed the maximum defined by
EXT2_MAX_BLOCK_LOG_SIZE (65536 byte blocks) at mount time, rejecting
the filesystem early if it does.

Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply at anthropic.com>
---
 fs/ext4/ext4_common.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
index a38593105f..094293a069 100644
--- a/fs/ext4/ext4_common.c
+++ b/fs/ext4/ext4_common.c
@@ -514,6 +514,14 @@ int ext4fs_mount(struct ext_filesystem *fs)
 		goto fail;
 	}
 
+	if (le32_to_cpu(data->sblock.log2_block_size) >
+	    EXT2_MAX_BLOCK_LOG_SIZE - EXT2_MIN_BLOCK_LOG_SIZE) {
+		dev_err(fs->dev, "invalid block size %u\n",
+			le32_to_cpu(data->sblock.log2_block_size));
+		ret = -EINVAL;
+		goto fail;
+	}
+
 	if (le32_to_cpu(data->sblock.revision_level) == 0) {
 		fs->inodesz = 128;
 		fs->gdsize = 32;

-- 
2.47.3