Linux EXT4 FS development
 help / color / mirror / Atom feed
From: Andreas Dilger <adilger@dilger.ca>
To: tytso@mit.edu
Cc: linux-ext4@vger.kernel.org, Andreas Dilger <adilger@dilger.ca>
Subject: [PATCH v2 1/2] e2fsck: limit blocks_per_group in get_backup_sb()
Date: Fri,  3 Jul 2026 17:29:32 -0600	[thread overview]
Message-ID: <20260703233023.666459-1-adilger@dilger.ca> (raw)

When e2fsck calls get_backup_sb() to scanning for backup superblocks
with large block sizes, it should limit the number of blocks per group
estimate of (blocksize * 8), otherwise it misses backup superblocks.

The bpg = (blocksize * 8) guess works for blocksize <= 4096, but with
large blocks this is limited by the __u16 bg_free_blocks_count field,
so at most any group will have ((1 << 16) - 8) = 65528 blocks.

Fixes: f7ef5f3e35 ("e2fsck: check all sparse_super backups")
Signed-off-by: Andreas Dilger <adilger@dilger.ca>
---
 e2fsck/util.c        | 11 +++++++++--
 lib/ext2fs/ext2_fs.h |  6 +++---
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/e2fsck/util.c b/e2fsck/util.c
index 7c17a3bad8..54b58369c6 100644
--- a/e2fsck/util.c
+++ b/e2fsck/util.c
@@ -562,13 +562,18 @@ blk64_t get_backup_sb(e2fsck_t ctx, ext2_filsys fs, const char *name,
 	void			*buf = NULL;
 	unsigned int		blocksize = EXT2_MIN_BLOCK_SIZE;
 	int			blocksize_known = 0;
-	blk_t			bpg = 0;
+	blk_t			bpg = 0, bpg_max;
 	blk64_t			ret_sb = 8193;
 
 	if (fs && fs->super) {
 		blocksize = fs->blocksize;
 		blocksize_known = 1;
 		bpg = fs->super->s_blocks_per_group;
+		bpg_max = EXT2_MAX_BLOCKS_PER_GROUP(fs->super);
+		if (bpg > bpg_max)
+			bpg = 0;
+	} else {
+		bpg_max = EXT2_MAX_CLUSTERS_PER_GROUP(NULL);
 	}
 
 	if (ctx && ctx->blocksize) {
@@ -588,10 +593,12 @@ blk64_t get_backup_sb(e2fsck_t ctx, ext2_filsys fs, const char *name,
 
 	for (; blocksize <= EXT2_MAX_BLOCK_SIZE; blocksize *= 2) {
 		dgrp_t grp, three = 1, five = 5, seven = 7;
-		dgrp_t limit;
 		blk_t this_bpg = bpg ? bpg : blocksize * 8;
+		dgrp_t limit;
 		blk64_t	num_blocks;
 
+		if (this_bpg > bpg_max)
+			this_bpg = bpg_max;
 		if (fs && fs->super) {
 			limit = ext2fs_blocks_count(fs->super) / this_bpg;
 		} else if (ctx && ext2fs_get_device_size2(ctx->filesystem_name,
diff --git a/lib/ext2fs/ext2_fs.h b/lib/ext2fs/ext2_fs.h
index fcd4205566..b1b0c179f3 100644
--- a/lib/ext2fs/ext2_fs.h
+++ b/lib/ext2fs/ext2_fs.h
@@ -287,11 +287,11 @@ struct ext2_dx_tail {
 #define EXT2_INODES_PER_GROUP(s)	(EXT2_SB(s)->s_inodes_per_group)
 #define EXT2_CLUSTERS_PER_GROUP(s)	(EXT2_SB(s)->s_clusters_per_group)
 #define EXT2_INODES_PER_BLOCK(s)	(EXT2_BLOCK_SIZE(s)/EXT2_INODE_SIZE(s))
-/* limits imposed by 16-bit value gd_free_{blocks,inode}_count */
-#define EXT2_MAX_BLOCKS_PER_GROUP(s)	((((unsigned) 1 << 16) - 8) *	\
+/* limits imposed by 16-bit value bg_free_{blocks,inode}_count */
+#define EXT2_MAX_CLUSTERS_PER_GROUP(s)	(((unsigned) 1 << 16) - 8)
+#define EXT2_MAX_BLOCKS_PER_GROUP(s)	(EXT2_MAX_CLUSTERS_PER_GROUP(super) * \
 					 (EXT2_CLUSTER_SIZE(s) / \
 					  EXT2_BLOCK_SIZE(s)))
-#define EXT2_MAX_CLUSTERS_PER_GROUP(s)	(((unsigned) 1 << 16) - 8)
 #define EXT2_MAX_INODES_PER_GROUP(s)	(((unsigned) 1 << 16) - \
 					 EXT2_INODES_PER_BLOCK(s))
 #ifdef __KERNEL__
-- 
2.52.0


             reply	other threads:[~2026-07-03 23:32 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-03 23:29 Andreas Dilger [this message]
2026-07-03 23:29 ` [PATCH v2 2/2] libext2fs: fix inode_blocks overflow in ext2fs_open() Andreas Dilger

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260703233023.666459-1-adilger@dilger.ca \
    --to=adilger@dilger.ca \
    --cc=linux-ext4@vger.kernel.org \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox