[PATCH 6.12.y] bcachefs: validate disk group parent chains

[PATCH 6.12.y] bcachefs: validate disk group parent chains

[Kyle Zeng]

Disk-group parent IDs are imported from the superblock and later
followed by bch2_sb_disk_groups_to_cpu() while it propagates live
devices to their parent groups. The superblock validator currently
checks member group IDs and duplicate labels, but it does not validate
the parent field of each non-deleted group.

Reject parent IDs outside the disk-group table, parents that reference
deleted groups, and cyclic parent chains before the groups are imported.
This prevents crafted superblocks from making the CPU conversion walk
past cpu_g->entries.

Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 fs/bcachefs/disk_groups.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/fs/bcachefs/disk_groups.c b/fs/bcachefs/disk_groups.c
index cde842a..52a0f44 100644
--- a/fs/bcachefs/disk_groups.c
+++ b/fs/bcachefs/disk_groups.c
@@ -26,6 +26,7 @@ static int bch2_sb_disk_groups_validate(struct bch_sb *sb, struct bch_sb_field *
 	struct bch_disk_group *g, *sorted = NULL;
 	unsigned nr_groups = disk_groups_nr(groups);
 	unsigned i, len;
+	unsigned int parent, depth;
 	int ret = 0;
 
 	for (i = 0; i < sb->nr_devices; i++) {
@@ -63,6 +64,34 @@ static int bch2_sb_disk_groups_validate(struct bch_sb *sb, struct bch_sb_field *
 			prt_printf(err, "label %u empty", i);
 			return -BCH_ERR_invalid_sb_disk_groups;
 		}
+
+		for (parent = BCH_GROUP_PARENT(g), depth = 0;
+		     parent;
+		     depth++) {
+			unsigned int parent_id = parent - 1;
+			struct bch_disk_group *parent_g;
+
+			if (depth == nr_groups) {
+				prt_printf(err, "label %u has cyclic parent chain", i);
+				return -BCH_ERR_invalid_sb_disk_groups;
+			}
+
+			if (parent_id >= nr_groups) {
+				prt_printf(err,
+					   "label %u has invalid parent %u (have %u)",
+					   i, parent_id, nr_groups);
+				return -BCH_ERR_invalid_sb_disk_groups;
+			}
+
+			parent_g = groups->entries + parent_id;
+			if (BCH_GROUP_DELETED(parent_g)) {
+				prt_printf(err, "label %u has deleted parent %u",
+					   i, parent_id);
+				return -BCH_ERR_invalid_sb_disk_groups;
+			}
+
+			parent = BCH_GROUP_PARENT(parent_g);
+		}
 	}
 
 	sorted = kmalloc_array(nr_groups, sizeof(*sorted), GFP_KERNEL);
-- 
2.54.0

Re: [PATCH 6.12.y] bcachefs: validate disk group parent chains

[Sasha Levin]

On Thu, Jun 11, 2026 at 03:38:35PM -0700, Kyle Zeng wrote:
> Reject parent IDs outside the disk-group table, parents that reference
> deleted groups, and cyclic parent chains before the groups are imported.
> This prevents crafted superblocks from making the CPU conversion walk
> past cpu_g->entries.

Thanks for the fix. I can't queue this for stable, though: there's no
upstream commit (bcachefs was removed from mainline after 6.12) and no
maintainer Reviewed-by/Acked-by. I won't take a stable-only change for
a removed subsystem without upstream presence or a maintainer ack.

If you can get Kent to review and ack it, I'll reconsider.

--
Thanks,
Sasha