[PATCH] ufs: reject oversized cylinder group metadata

[David Lee <david.lee@trailofbits.com>]

The on-disk cylinder group size becomes the fragment count used by
ufs_read_cylinder(). A size larger than one filesystem block makes that
count exceed UFS_MAXFRAG and drives buffer-head stores beyond the fixed
eight-entry array in struct ufs_cg_private_info.

Reject zero-sized cylinder groups and sizes larger than the validated
filesystem block size while reading the superblock. Since a filesystem
block contains at most UFS_MAXFRAG fragments, every later cylinder cache
count is then bounded by its buffer-head array.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Codex:gpt-5.5
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
 fs/ufs/super.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index c4831a8b9b3f..fa2effdec7b0 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -1140,6 +1140,11 @@ static int ufs_fill_super(struct super_block *sb, struct fs_context *fc)
 
 	uspi->s_cssize = fs32_to_cpu(sb, usb1->fs_cssize);
 	uspi->s_cgsize = fs32_to_cpu(sb, usb1->fs_cgsize);
+	if (uspi->s_cgsize == 0 || uspi->s_cgsize > uspi->s_bsize) {
+		pr_err("%s(): invalid cylinder group size %u\n",
+		       __func__, uspi->s_cgsize);
+		goto failed;
+	}
 	uspi->s_ntrak = fs32_to_cpu(sb, usb1->fs_ntrak);
 	uspi->s_nsect = fs32_to_cpu(sb, usb1->fs_nsect);
 	uspi->s_spc = fs32_to_cpu(sb, usb1->fs_spc);
-- 
2.43.0