[PATCH 6.12.y] bcachefs: validate disk group parent chains

[Kyle Zeng <kylebot@openai.com>]

Disk-group parent IDs are imported from the superblock and later
followed by bch2_sb_disk_groups_to_cpu() while it propagates live
devices to their parent groups. The superblock validator currently
checks member group IDs and duplicate labels, but it does not validate
the parent field of each non-deleted group.

Reject parent IDs outside the disk-group table, parents that reference
deleted groups, and cyclic parent chains before the groups are imported.
This prevents crafted superblocks from making the CPU conversion walk
past cpu_g->entries.

Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 fs/bcachefs/disk_groups.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/fs/bcachefs/disk_groups.c b/fs/bcachefs/disk_groups.c
index cde842a..52a0f44 100644
--- a/fs/bcachefs/disk_groups.c
+++ b/fs/bcachefs/disk_groups.c
@@ -26,6 +26,7 @@ static int bch2_sb_disk_groups_validate(struct bch_sb *sb, struct bch_sb_field *
 	struct bch_disk_group *g, *sorted = NULL;
 	unsigned nr_groups = disk_groups_nr(groups);
 	unsigned i, len;
+	unsigned int parent, depth;
 	int ret = 0;
 
 	for (i = 0; i < sb->nr_devices; i++) {
@@ -63,6 +64,34 @@ static int bch2_sb_disk_groups_validate(struct bch_sb *sb, struct bch_sb_field *
 			prt_printf(err, "label %u empty", i);
 			return -BCH_ERR_invalid_sb_disk_groups;
 		}
+
+		for (parent = BCH_GROUP_PARENT(g), depth = 0;
+		     parent;
+		     depth++) {
+			unsigned int parent_id = parent - 1;
+			struct bch_disk_group *parent_g;
+
+			if (depth == nr_groups) {
+				prt_printf(err, "label %u has cyclic parent chain", i);
+				return -BCH_ERR_invalid_sb_disk_groups;
+			}
+
+			if (parent_id >= nr_groups) {
+				prt_printf(err,
+					   "label %u has invalid parent %u (have %u)",
+					   i, parent_id, nr_groups);
+				return -BCH_ERR_invalid_sb_disk_groups;
+			}
+
+			parent_g = groups->entries + parent_id;
+			if (BCH_GROUP_DELETED(parent_g)) {
+				prt_printf(err, "label %u has deleted parent %u",
+					   i, parent_id);
+				return -BCH_ERR_invalid_sb_disk_groups;
+			}
+
+			parent = BCH_GROUP_PARENT(parent_g);
+		}
 	}
 
 	sorted = kmalloc_array(nr_groups, sizeof(*sorted), GFP_KERNEL);
-- 
2.54.0