From patchwork Mon Apr 22 02:57:05 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Theodore Ts'o X-Patchwork-Id: 238286 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id A98032C00B5 for ; Mon, 22 Apr 2013 12:57:19 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754455Ab3DVC5J (ORCPT ); Sun, 21 Apr 2013 22:57:09 -0400 Received: from li9-11.members.linode.com ([67.18.176.11]:43339 "EHLO imap.thunk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754397Ab3DVC5I (ORCPT ); Sun, 21 Apr 2013 22:57:08 -0400 Received: from root (helo=closure.thunk.org) by imap.thunk.org with local-esmtp (Exim 4.80) (envelope-from ) id 1UU6wi-0004Af-CP; Mon, 22 Apr 2013 02:57:36 +0000 Received: by closure.thunk.org (Postfix, from userid 15806) id 34613582459; Sun, 21 Apr 2013 22:57:05 -0400 (EDT) From: Theodore Ts'o To: Ext4 Developers List Cc: Theodore Ts'o , stable@vger.kernel.org Subject: [PATCH] ext4: add check for inodes_count overflow in new resize ioctl Date: Sun, 21 Apr 2013 22:57:05 -0400 Message-Id: <1366599425-11561-1-git-send-email-tytso@mit.edu> X-Mailer: git-send-email 1.7.12.rc0.22.gcdd159b X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: tytso@thunk.org X-SA-Exim-Scanned: No (on imap.thunk.org); SAEximRunCond expanded to false Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org Addresses-Red-Hat-Bugzilla: #913245 Reported-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Cc: stable@vger.kernel.org Reviewed-by: Carlos Maiolino --- fs/ext4/resize.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 08d2312..b27c96d 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1882,6 +1882,10 @@ retry: return 0; n_group = ext4_get_group_number(sb, n_blocks_count - 1); + if (n_group > (0xFFFFFFFFUL / EXT4_INODES_PER_GROUP(sb))) { + ext4_warning(sb, "resize would cause inodes_count overflow"); + return -EINVAL; + } ext4_get_group_no_and_offset(sb, o_blocks_count - 1, &o_group, &offset); n_desc_blocks = num_desc_blocks(sb, n_group + 1);