[PATCH 2/5] fs: ext4: reject superblocks with zero inodesz, gdsize or inodes_per_group

[Ahmad Fatoum]

On 4/2/26 12:12 PM, Sascha Hauer wrote:
> The superblock fields inode_size, descriptor_size, and inodes_per_group
> are read from disk and used as divisors without validation:
> 
>   - inodesz == 0: division by zero in ext4fs_read_inode()
>   - gdsize == 0: division by zero in ext4fs_blockgroup()
>   - inodes_per_group == 0: division by zero in ext4fs_read_inode()
> 
> All three are trivially triggered by a crafted filesystem image.
> 
> Validate these fields are non-zero at mount time and reject the
> filesystem if they aren't.
> 
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply at anthropic.com>

Reviewed-by: Ahmad Fatoum <a.fatoum at pengutronix.de>

> ---
>  fs/ext4/ext4_common.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
> index 094293a069..5d252b4a2c 100644
> --- a/fs/ext4/ext4_common.c
> +++ b/fs/ext4/ext4_common.c
> @@ -541,6 +541,15 @@ int ext4fs_mount(struct ext_filesystem *fs)
>  	      le32_to_cpu(data->sblock.revision_level),
>  	      fs->inodesz, fs->gdsize);
>  
> +	if (!fs->inodesz || !fs->gdsize ||
> +	    !le32_to_cpu(data->sblock.inodes_per_group)) {
> +		dev_err(fs->dev, "invalid superblock: inodesz=%u gdsize=%u inodes_per_group=%u\n",
> +			fs->inodesz, fs->gdsize,
> +			le32_to_cpu(data->sblock.inodes_per_group));
> +		ret = -EINVAL;
> +		goto fail;
> +	}
> +
>  	data->diropen.data = data;
>  	data->diropen.ino = 2;
>  	data->diropen.inode_read = 1;
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |