[PATCH] minix: validate s_imap_blocks and s_zmap_blocks in minix_check_superblock()

[Hui Peng]

In minix_check_superblock() and minix_fill_super() (fs/minix/inode.c),
verify that s_imap_blocks and s_zmap_blocks are large enough to cover
s_ninodes + 1 and s_zones, and check the return value of
sb_set_blocksize() to prevent out-of-bounds bitmap array reads in
minix_count_free_inodes() and minix_new_inode().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index daf83e4ff25c..b0857dfc1b46 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -185,15 +185,15 @@ static bool minix_check_superblock(struct super_block *sb)
 		return false;
 	}
 
-	if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
-	    sbi->s_firstdatazone >= sbi->s_nzones)
+	if (sbi->s_ninodes == 0 || sbi->s_ninodes == UINT_MAX ||
+	    sbi->s_firstdatazone <= 4 || sbi->s_firstdatazone >= sbi->s_nzones)
 		return false;
 
 	/* Apparently minix can create filesystems that allocate more blocks for
 	 * the bitmaps than needed.  We simply ignore that, but verify it didn't
 	 * create one with not enough blocks and bail out if so.
 	 */
-	block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize);
+	block = minix_blocks_needed((u64)sbi->s_ninodes + 1, sb->s_blocksize);
 	if (sbi->s_imap_blocks < block) {
 		printk("MINIX-fs: file system does not have enough "
 		       "imap blocks allocated. Refusing to mount.\n");
@@ -201,7 +201,7 @@ static bool minix_check_superblock(struct super_block *sb)
 	}
 
 	block = minix_blocks_needed(
-			(sbi->s_nzones - sbi->s_firstdatazone + 1),
+			(u64)sbi->s_nzones - sbi->s_firstdatazone + 1,
 			sb->s_blocksize);
 	if (sbi->s_zmap_blocks < block) {
 		printk("MINIX-fs: file system does not have enough "