The on-disk cylinder group size becomes the fragment count used by ufs_read_cylinder(). A size larger than one filesystem block makes that count exceed UFS_MAXFRAG and drives buffer-head stores beyond the fixed eight-entry array in struct ufs_cg_private_info. Reject zero-sized cylinder groups and sizes larger than the validated filesystem block size while reading the superblock. Since a filesystem block contains at most UFS_MAXFRAG fragments, every later cylinder cache count is then bounded by its buffer-head array. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: Codex:gpt-5.5 Signed-off-by: David Lee --- fs/ufs/super.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ufs/super.c b/fs/ufs/super.c index c4831a8b9b3f..fa2effdec7b0 100644 --- a/fs/ufs/super.c +++ b/fs/ufs/super.c @@ -1140,6 +1140,11 @@ static int ufs_fill_super(struct super_block *sb, struct fs_context *fc) uspi->s_cssize = fs32_to_cpu(sb, usb1->fs_cssize); uspi->s_cgsize = fs32_to_cpu(sb, usb1->fs_cgsize); + if (uspi->s_cgsize == 0 || uspi->s_cgsize > uspi->s_bsize) { + pr_err("%s(): invalid cylinder group size %u\n", + __func__, uspi->s_cgsize); + goto failed; + } uspi->s_ntrak = fs32_to_cpu(sb, usb1->fs_ntrak); uspi->s_nsect = fs32_to_cpu(sb, usb1->fs_nsect); uspi->s_spc = fs32_to_cpu(sb, usb1->fs_spc); -- 2.43.0