[PATCH 1/5] fs: ext4: validate log2_block_size from superblock at mount

Sascha Hauer
2026-04-02T10:13:21Z

The superblock's log2_block_size field is read from disk and used
throughout the ext4 code without validation. EXT2_BLOCK_SIZE() computes
1 << (log2_block_size + 10), so a crafted value of 22 or larger causes
undefined behavior from shifting an int by >= 32 bits.

This leads to wrong allocation sizes for indirect block buffers and
enables downstream buffer overflows in every function that reads
block-sized data.

Validate that log2_block_size does not exceed the maximum defined by
EXT2_MAX_BLOCK_LOG_SIZE (65536 byte blocks) at mount time, rejecting
the filesystem early if it does.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
fs/ext4/ext4_common.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
index a38593105f..094293a069 100644
--- a/fs/ext4/ext4_common.c
+++ b/fs/ext4/ext4_common.c
@@ -514,6 +514,14 @@ int ext4fs_mount(struct ext_filesystem *fs)
goto fail;
}

+ if (le32_to_cpu(data->sblock.log2_block_size) >
+ EXT2_MAX_BLOCK_LOG_SIZE - EXT2_MIN_BLOCK_LOG_SIZE) {
+ dev_err(fs->dev, "invalid block size %u\n",
+ le32_to_cpu(data->sblock.log2_block_size));
+ ret = -EINVAL;
+ goto fail;
+ }
+
if (le32_to_cpu(data->sblock.revision_level) == 0) {
fs->inodesz = 128;
fs->gdsize = 32;

--
2.47.3