From fc16c847a1c9c6e0ee1f605849cc500a04c21602 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20tp=20Prei=C3=9Fl?= Date: Fri, 9 Jan 2026 11:25:07 +0000 Subject: [PATCH] fs: prevent integer overflow in ext4fs_get_bgdtable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit An integer overflow in gdsize_total calculation could lead to under-allocation and heap buffer overflow. Signed-off-by: Timo tp Preißl Reviewed-by: Simon Glass Reviewed-by: Tom Rini --- fs/ext4/ext4_write.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/ext4/ext4_write.c b/fs/ext4/ext4_write.c index 5b290f0d80d..1483e9955c0 100644 --- a/fs/ext4/ext4_write.c +++ b/fs/ext4/ext4_write.c @@ -108,7 +108,13 @@ int ext4fs_get_bgdtable(void) { int status; struct ext_filesystem *fs = get_fs(); - int gdsize_total = ROUND(fs->no_blkgrp * fs->gdsize, fs->blksz); + size_t alloc; + size_t gdsize_total; + + if (__builtin_mul_overflow(fs->no_blkgrp, fs->gdsize, &alloc)) + return -1; + + gdsize_total = ROUND(alloc, fs->blksz); fs->no_blk_pergdt = gdsize_total / fs->blksz; /* allocate memory for gdtable */