[PATCH 4/4] fs: ext4: preventing integer overflow in ext4fs_get_bgdtable()

Timo tp Preißl t.preissl at proton.me
Sun Dec 28 17:45:34 CET 2025


Signed-off-by: Timo tp Preißl <t.preissl at proton.me>
---
 fs/ext4/ext4_write.c | 7 ++++++-
 fs/fs.c              | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/ext4_write.c b/fs/ext4/ext4_write.c
index 5b290f0d80d..02cf9cf0cc3 100644
--- a/fs/ext4/ext4_write.c
+++ b/fs/ext4/ext4_write.c
@@ -108,7 +108,12 @@ int ext4fs_get_bgdtable(void)
 {
 	int status;
 	struct ext_filesystem *fs = get_fs();
-	int gdsize_total = ROUND(fs->no_blkgrp * fs->gdsize, fs->blksz);
+	size_t alloc;
+
+	if (__builtin_mul_overflow(fs->no_blkgrp ,fs->gdsize, &alloc))
+		return -1;
+
+	size_t gdsize_total = ROUND(alloc, fs->blksz);
 	fs->no_blk_pergdt = gdsize_total / fs->blksz;
 
 	/* allocate memory for gdtable */
diff --git a/fs/fs.c b/fs/fs.c
index efcf94caa1b..f22b75573b9 100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -1071,7 +1071,7 @@ int do_mv(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[],
 
 		if (__builtin_add_overflow(dst_len, src_len, &total) ||
    			__builtin_add_overflow(total, 2, &total)) {
-  	  	return 0;
+  	  		return 0;
 		}
 
 		new_dst = calloc(1, total);
-- 
2.43.0




More information about the U-Boot mailing list