Unverified Commit ab7ad7ab authored by Deepanshu Kartikey's avatar Deepanshu Kartikey Committed by Christian Brauner
Browse files

romfs: check sb_set_blocksize() return value 



romfs_fill_super() ignores the return value of sb_set_blocksize(), which
can fail if the requested block size is incompatible with the block
device's configuration.

This can be triggered by setting a loop device's block size larger than
PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs
filesystem on that device.

When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the
device has logical_block_size=32768, bdev_validate_blocksize() fails
because the requested size is smaller than the device's logical block
size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and
continues mounting.

The superblock's block size remains at the device's logical block size
(32768). Later, when sb_bread() attempts I/O with this oversized block
size, it triggers a kernel BUG in folio_set_bh():

    kernel BUG at fs/buffer.c:1582!
    BUG_ON(size > PAGE_SIZE);

Fix by checking the return value of sb_set_blocksize() and failing the
mount with -EINVAL if it returns 0.

Reported-by: default avatar <syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25


Signed-off-by: default avatarDeepanshu Kartikey <kartikey406@gmail.com>
Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent e1668808

fs/romfs/super.c

+4 −1
Original line number Diff line number Diff line
@@ -458,7 +458,10 @@ static int romfs_fill_super(struct super_block *sb, struct fs_context *fc) 


#ifdef CONFIG_BLOCK

	if (!sb->s_mtd) {

		sb_set_blocksize(sb, ROMBSIZE);

		if (!sb_set_blocksize(sb, ROMBSIZE)) {

			errorf(fc, "romfs: unable to set blocksize\n");

			return -EINVAL;

		}

	} else {

		sb->s_blocksize = ROMBSIZE;

		sb->s_blocksize_bits = blksize_bits(ROMBSIZE);