Re: [PATCH] ufs: reject oversized cylinder group metadata

[Ali Ahmet Memis]

I traced the count assignment this patch protects. ufs_read_cylinder()
in fs/ufs/cylinder.c sets UCPI_UBH(ucpi)->count directly from
s_cgsize >> s_blocksize_bits and then stores into bh[i] in a loop, so it
does not go through the UFS_MAXFRAG clamp that _ubh_bread_() and
ubh_bread_uspi() apply in fs/ufs/util.c. An oversized fs_cgsize
therefore does drive buffer-head stores past the fixed eight entry array
in struct ufs_cg_private_info, as the changelog says.

The new bound is sufficient. ufs_fill_super() already rejects a
filesystem whose s_bsize over s_fsize ratio is larger than eight, so
once s_cgsize is held at or below s_bsize the derived count stays at or
under UFS_MAXFRAG and the bh[] loop is in range. Rejecting a zero sized
cylinder group at the same point is a sensible guard as well.

Reviewed-by: Ali Ahmet Memis <ali@xxxxxxxxxxxxxx>