All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sriram Sriram <sriramsriram@linux.microsoft.com>
To: u-boot@lists.u-boot-project.org
Cc: Tom Rini <trini@konsulko.com>,
	Jerome Forissier <jerome.forissier@arm.com>,
	Simon Glass <sjg@chromium.org>,
	Drew Kluemke <ankluemk@microsoft.com>,
	Daniel Munic <v-dmunic@microsoft.com>,
	Sriram Sriram <sriramsriram@linux.microsoft.com>
Subject: [PATCH 4/4] fs: ext4: widen ext4fs_update() block-group loop counter
Date: Wed,  9 Sep 2026 12:20:16 -0700	[thread overview]
Message-ID: <20260909192016.217183-5-sriramsriram@linux.microsoft.com> (raw)
In-Reply-To: <20260909192016.217183-1-sriramsriram@linux.microsoft.com>

From: Daniel Munic <v-dmunic@microsoft.com>

ext4fs_update() iterates over all block groups with a signed 16-bit
loop counter:

	short i;
	...
	for (i = 0; i < fs->no_blkgrp; i++)

fs->no_blkgrp is a uint32_t. On a filesystem with more than 32767
block groups the counter cannot represent every index: incrementing
past SHRT_MAX is signed overflow (undefined behaviour) and the
comparison against the unsigned no_blkgrp never terminates correctly,
so the bitmap/group-descriptor write-back loops misbehave. The mixed
signed/unsigned comparison is also flagged by static analysis.

Use u32 for the loop counter, matching the width of no_blkgrp.

Signed-off-by: Daniel Munic <v-dmunic@microsoft.com>
Signed-off-by: Sriram Sriram <sriramsriram@linux.microsoft.com>
---
 fs/ext4/ext4_write.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/ext4_write.c b/fs/ext4/ext4_write.c
index 1abedcede72..2fba2197c19 100644
--- a/fs/ext4/ext4_write.c
+++ b/fs/ext4/ext4_write.c
@@ -67,7 +67,7 @@ static inline void ext4fs_bg_free_blocks_inc
 
 static void ext4fs_update(void)
 {
-	short i;
+	u32 i;
 	ext4fs_update_journal();
 	struct ext_filesystem *fs = get_fs();
 	struct ext2_block_group *bgd = NULL;
-- 
2.49.0


      parent reply	other threads:[~2026-09-09 20:45 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-09 19:20 [PATCH 0/4] Bounds/overflow hardening in NFS, FIT, TFTP and ext4 Sriram Sriram
2026-09-09 19:20 ` [PATCH 1/4] net: nfs: add bounds checks on memcpy into stack-allocated rpc_pkt Sriram Sriram
2026-09-09 19:20 ` [PATCH 2/4] boot: image-fit: add overflow guard for FIT decompression buffer Sriram Sriram
2026-09-10 19:09   ` Tom Rini
2026-09-09 19:20 ` [PATCH 3/4] net: tftp: use bounded string compare for OACK option parsing Sriram Sriram
2026-09-10 19:25   ` Tom Rini
2026-09-09 19:20 ` Sriram Sriram [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260909192016.217183-5-sriramsriram@linux.microsoft.com \
    --to=sriramsriram@linux.microsoft.com \
    --cc=ankluemk@microsoft.com \
    --cc=jerome.forissier@arm.com \
    --cc=sjg@chromium.org \
    --cc=trini@konsulko.com \
    --cc=u-boot@lists.u-boot-project.org \
    --cc=v-dmunic@microsoft.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.