From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964991AbbA1EXo (ORCPT ); Tue, 27 Jan 2015 23:23:44 -0500 Received: from mail.kernel.org ([198.145.29.136]:40405 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S964977AbbA1EXj (ORCPT ); Tue, 27 Jan 2015 23:23:39 -0500 From: lizf@kernel.org To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Jan Kara , "Theodore Ts'o" , Zefan Li Subject: [PATCH 3.4 115/177] ext4: fix overflow when updating superblock backups after resize Date: Wed, 28 Jan 2015 12:09:33 +0800 Message-Id: <1422418236-12852-206-git-send-email-lizf@kernel.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1422418050-12581-1-git-send-email-lizf@kernel.org> References: <1422418050-12581-1-git-send-email-lizf@kernel.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jan Kara 3.4.106-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 9378c6768e4fca48971e7b6a9075bc006eda981d upstream. When there are no meta block groups update_backups() will compute the backup block in 32-bit arithmetics thus possibly overflowing the block number and corrupting the filesystem. OTOH filesystems without meta block groups larger than 16 TB should be rare. Fix the problem by doing the counting in 64-bit arithmetics. Coverity-id: 741252 Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o Reviewed-by: Lukas Czerner [lizf: Backported to 3.4: adjust context] Signed-off-by: Zefan Li --- fs/ext4/resize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index a43e43c..cfd3211 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -991,7 +991,7 @@ static void update_backups(struct super_block *sb, (err = ext4_journal_restart(handle, EXT4_MAX_TRANS_DATA))) break; - bh = sb_getblk(sb, group * bpg + blk_off); + bh = sb_getblk(sb, ((ext4_fsblk_t)group) * bpg + blk_off); if (!bh) { err = -ENOMEM; break; -- 1.9.1