Merge patch series "ufs: harden the mount path against malformed images"

Ali Ahmet Memis <ali@iusegentoo.com> says:

Two robustness fixes for the ufs mount path, both reachable by mounting
a crafted UFS image.

Patch 1 reorders ufs_fill_super() so the root dentry is created after the
cylinder group metadata is loaded. Today a failure while reading the
cylinder groups drops UFS_SB(sb) but leaves s_root installed, so the
generic teardown oopses on a NULL pointer in ufs_sync_fs() and the
put_super operation.

Patch 2 validates the cylinder group index and the rotor positions in
ufs_read_cylinder() before they are cached. Unchecked, c_cgx indexes the
cylinder summary array (a 32 bit write outside s_csp), and the rotors
become bitmap scan offsets that can wrap an unsigned length and walk past
the cylinder group buffers during an ordinary allocation.

* patches from https://patch.msgid.link/20260801071306.59484-1-ali@iusegentoo.com:
  ufs: validate cylinder group metadata before caching it
  ufs: create the root dentry after loading cylinder metadata

Link: https://patch.msgid.link/20260801071306.59484-1-ali@iusegentoo.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

0 files changed, 0 insertions, 0 deletions