[PATCH 1/5] fs: ext4: validate log2_block_size from superblock at mount

[Ahmad Fatoum]

On 4/2/26 12:12 PM, Sascha Hauer wrote:
> The superblock's log2_block_size field is read from disk and used
> throughout the ext4 code without validation. EXT2_BLOCK_SIZE() computes
> 1 << (log2_block_size + 10), so a crafted value of 22 or larger causes
> undefined behavior from shifting an int by >= 32 bits.
> 
> This leads to wrong allocation sizes for indirect block buffers and
> enables downstream buffer overflows in every function that reads
> block-sized data.
> 
> Validate that log2_block_size does not exceed the maximum defined by
> EXT2_MAX_BLOCK_LOG_SIZE (65536 byte blocks) at mount time, rejecting
> the filesystem early if it does.
> 
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply at anthropic.com>

Reviewed-by: Ahmad Fatoum <a.fatoum at pengutronix.de>

This is analogous to Linux commit 62aeb94433fc ("ext2: Check block size
validity during mount"), which addressed a Syzbot report in 2023.

> ---
>  fs/ext4/ext4_common.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
> index a38593105f..094293a069 100644
> --- a/fs/ext4/ext4_common.c
> +++ b/fs/ext4/ext4_common.c
> @@ -514,6 +514,14 @@ int ext4fs_mount(struct ext_filesystem *fs)
>  		goto fail;
>  	}
>  
> +	if (le32_to_cpu(data->sblock.log2_block_size) >
> +	    EXT2_MAX_BLOCK_LOG_SIZE - EXT2_MIN_BLOCK_LOG_SIZE) {
> +		dev_err(fs->dev, "invalid block size %u\n",> +		
le32_to_cpu(data->sblock.log2_block_size));
> +		ret = -EINVAL;
> +		goto fail;
> +	}
> +
>  	if (le32_to_cpu(data->sblock.revision_level) == 0) {
>  		fs->inodesz = 128;
>  		fs->gdsize = 32;
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |