Re: [BUG] ufs: crafted writable mount can overflow cylinder summary buffer

[Greg KH]

On Wed, Jun 17, 2026 at 11:42:40PM +0900, 이상호 wrote:
> Hello,
> 
> I am reporting a UFS/FFS mount-time memory corruption issue in
> ufs_read_cylinder_structures().
> 
> A crafted UFS/FFS filesystem image can set inconsistent cylinder-summary
> geometry so that the kernel allocates kmalloc(s_cssize) but copies more than
> that allocation while reading cylinder summary blocks during a writable UFS
> mount.

No need to cc: the security list for this, it's just a "normal" bug to
fix.  Please submit a patch to resolve it if you wish to see it fixed in
the kernel or even better, in the userspace fsck tool.

thanks,

greg k-h