[PATCH] gfs2: add bounds check for rd_length in compute_bitstructs()

[Kriish Sharma <kriish.sharma2006@gmail.com>]

compute_bitstructs() allocates an array of gfs2_bitmap structures
using kcalloc(). The function only checked for length == 0 but did not
guard against excessively large length values.

If rd_length is too large, the multiplication inside
kcalloc(length, sizeof(struct gfs2_bitmap), GFP_NOFS) can exceed
KMALLOC_MAX_SIZE. This leads to the allocator calculating an order
greater than MAX_ORDER when calling get_order(), which is invalid.
As a result, __alloc_pages() warns about the bad request.

This patch adds an explicit check that rd_length is not only non-zero
but also within the maximum safe limit for kmalloc_array():
    length <= KMALLOC_MAX_SIZE / sizeof(struct gfs2_bitmap)

This ensures that get_order() is only ever called with a valid size,
resulting in an allocation order within MAX_ORDER

Fixes: b9158815de52 ("Merge tag 'char-misc-6.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc")
Reported-by: syzbot+7567dc5c8aa8f68bde74@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7567dc5c8aa8f68bde74

Signed-off-by: Kriish Sharma <kriish.sharma2006@gmail.com>
---
 fs/gfs2/rgrp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 26d6c1eea559..a879e8030568 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -760,7 +760,7 @@ static int compute_bitstructs(struct gfs2_rgrpd *rgd)
 	u32 bytes_left, bytes;
 	int x;
 
-	if (!length)
+	if (!length || length > KMALLOC_MAX_SIZE / sizeof(struct gfs2_bitmap))
 		return -EINVAL;
 
 	rgd->rd_bits = kcalloc(length, sizeof(struct gfs2_bitmap), GFP_NOFS);
-- 
2.34.1