From: Andreas Dilger <adilger@dilger.ca>
To: tytso@mit.edu
Cc: linux-ext4@vger.kernel.org, Andreas Dilger <adilger@dilger.ca>
Subject: [PATCH v2 1/2] e2fsck: limit blocks_per_group in get_backup_sb()
Date: Fri, 3 Jul 2026 17:29:32 -0600 [thread overview]
Message-ID: <20260703233023.666459-1-adilger@dilger.ca> (raw)
When e2fsck calls get_backup_sb() to scanning for backup superblocks
with large block sizes, it should limit the number of blocks per group
estimate of (blocksize * 8), otherwise it misses backup superblocks.
The bpg = (blocksize * 8) guess works for blocksize <= 4096, but with
large blocks this is limited by the __u16 bg_free_blocks_count field,
so at most any group will have ((1 << 16) - 8) = 65528 blocks.
Fixes: f7ef5f3e35 ("e2fsck: check all sparse_super backups")
Signed-off-by: Andreas Dilger <adilger@dilger.ca>
---
e2fsck/util.c | 11 +++++++++--
lib/ext2fs/ext2_fs.h | 6 +++---
2 files changed, 12 insertions(+), 5 deletions(-)
diff --git a/e2fsck/util.c b/e2fsck/util.c
index 7c17a3bad8..54b58369c6 100644
--- a/e2fsck/util.c
+++ b/e2fsck/util.c
@@ -562,13 +562,18 @@ blk64_t get_backup_sb(e2fsck_t ctx, ext2_filsys fs, const char *name,
void *buf = NULL;
unsigned int blocksize = EXT2_MIN_BLOCK_SIZE;
int blocksize_known = 0;
- blk_t bpg = 0;
+ blk_t bpg = 0, bpg_max;
blk64_t ret_sb = 8193;
if (fs && fs->super) {
blocksize = fs->blocksize;
blocksize_known = 1;
bpg = fs->super->s_blocks_per_group;
+ bpg_max = EXT2_MAX_BLOCKS_PER_GROUP(fs->super);
+ if (bpg > bpg_max)
+ bpg = 0;
+ } else {
+ bpg_max = EXT2_MAX_CLUSTERS_PER_GROUP(NULL);
}
if (ctx && ctx->blocksize) {
@@ -588,10 +593,12 @@ blk64_t get_backup_sb(e2fsck_t ctx, ext2_filsys fs, const char *name,
for (; blocksize <= EXT2_MAX_BLOCK_SIZE; blocksize *= 2) {
dgrp_t grp, three = 1, five = 5, seven = 7;
- dgrp_t limit;
blk_t this_bpg = bpg ? bpg : blocksize * 8;
+ dgrp_t limit;
blk64_t num_blocks;
+ if (this_bpg > bpg_max)
+ this_bpg = bpg_max;
if (fs && fs->super) {
limit = ext2fs_blocks_count(fs->super) / this_bpg;
} else if (ctx && ext2fs_get_device_size2(ctx->filesystem_name,
diff --git a/lib/ext2fs/ext2_fs.h b/lib/ext2fs/ext2_fs.h
index fcd4205566..b1b0c179f3 100644
--- a/lib/ext2fs/ext2_fs.h
+++ b/lib/ext2fs/ext2_fs.h
@@ -287,11 +287,11 @@ struct ext2_dx_tail {
#define EXT2_INODES_PER_GROUP(s) (EXT2_SB(s)->s_inodes_per_group)
#define EXT2_CLUSTERS_PER_GROUP(s) (EXT2_SB(s)->s_clusters_per_group)
#define EXT2_INODES_PER_BLOCK(s) (EXT2_BLOCK_SIZE(s)/EXT2_INODE_SIZE(s))
-/* limits imposed by 16-bit value gd_free_{blocks,inode}_count */
-#define EXT2_MAX_BLOCKS_PER_GROUP(s) ((((unsigned) 1 << 16) - 8) * \
+/* limits imposed by 16-bit value bg_free_{blocks,inode}_count */
+#define EXT2_MAX_CLUSTERS_PER_GROUP(s) (((unsigned) 1 << 16) - 8)
+#define EXT2_MAX_BLOCKS_PER_GROUP(s) (EXT2_MAX_CLUSTERS_PER_GROUP(super) * \
(EXT2_CLUSTER_SIZE(s) / \
EXT2_BLOCK_SIZE(s)))
-#define EXT2_MAX_CLUSTERS_PER_GROUP(s) (((unsigned) 1 << 16) - 8)
#define EXT2_MAX_INODES_PER_GROUP(s) (((unsigned) 1 << 16) - \
EXT2_INODES_PER_BLOCK(s))
#ifdef __KERNEL__
--
2.52.0
next reply other threads:[~2026-07-03 23:32 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-03 23:29 Andreas Dilger [this message]
2026-07-03 23:29 ` [PATCH v2 2/2] libext2fs: fix inode_blocks overflow in ext2fs_open() Andreas Dilger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260703233023.666459-1-adilger@dilger.ca \
--to=adilger@dilger.ca \
--cc=linux-ext4@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox