Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760643AbaLLGbl (ORCPT ); Fri, 12 Dec 2014 01:31:41 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:51973 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759343AbaLLGQ6 (ORCPT ); Fri, 12 Dec 2014 01:16:58 -0500 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Theodore Ts'o" , "Jan Kara" , "Lukas Czerner" Date: Fri, 12 Dec 2014 06:14:25 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.2 097/164] ext4: fix overflow when updating superblock backups after resize In-Reply-To: X-SA-Exim-Connect-IP: 2001:470:1f08:1539:c97:8151:cc89:c28d X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.2.65-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Jan Kara commit 9378c6768e4fca48971e7b6a9075bc006eda981d upstream. When there are no meta block groups update_backups() will compute the backup block in 32-bit arithmetics thus possibly overflowing the block number and corrupting the filesystem. OTOH filesystems without meta block groups larger than 16 TB should be rare. Fix the problem by doing the counting in 64-bit arithmetics. Coverity-id: 741252 Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o Reviewed-by: Lukas Czerner [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings --- fs/ext4/resize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -692,7 +692,7 @@ static void update_backups(struct super_ (err = ext4_journal_restart(handle, EXT4_MAX_TRANS_DATA))) break; - bh = sb_getblk(sb, group * bpg + blk_off); + bh = sb_getblk(sb, (ext4_fsblk_t)group * bpg + blk_off); if (!bh) { err = -ENOMEM; break; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/