From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Jan Kara <jack@suse.cz>,
Theodore Tso <tytso@mit.edu>
Subject: [ 15/18] ext4: fix data offset overflow in ext4_xattr_fiemap() on 32-bit archs
Date: Thu, 18 Jul 2013 19:23:30 -0700 [thread overview]
Message-ID: <20130719021050.003259613@linuxfoundation.org> (raw)
In-Reply-To: <20130719021048.965829361@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit a60697f411eb365fb09e639e6f183fe33d1eb796 upstream.
On 32-bit architectures with 32-bit sector_t computation of data offset
in ext4_xattr_fiemap() can overflow resulting in reporting bogus data
location. Fix the problem by typing block number to proper type before
shifting.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/extents.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4155,7 +4155,7 @@ static int ext4_xattr_fiemap(struct inod
error = ext4_get_inode_loc(inode, &iloc);
if (error)
return error;
- physical = iloc.bh->b_blocknr << blockbits;
+ physical = (__u64)iloc.bh->b_blocknr << blockbits;
offset = EXT4_GOOD_OLD_INODE_SIZE +
EXT4_I(inode)->i_extra_isize;
physical += offset;
@@ -4163,7 +4163,7 @@ static int ext4_xattr_fiemap(struct inod
flags |= FIEMAP_EXTENT_DATA_INLINE;
brelse(iloc.bh);
} else { /* external block */
- physical = EXT4_I(inode)->i_file_acl << blockbits;
+ physical = (__u64)EXT4_I(inode)->i_file_acl << blockbits;
length = inode->i_sb->s_blocksize;
}
next prev parent reply other threads:[~2013-07-19 2:33 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-19 2:23 [ 00/18] 3.0.87-stable review Greg Kroah-Hartman
2013-07-19 2:23 ` [ 01/18] jbd2: fix theoretical race in jbd2__journal_restart Greg Kroah-Hartman
2013-07-19 2:23 ` [ 02/18] ext3,ext4: dont mess with dir_file->f_pos in htree_dirblock_to_tree() Greg Kroah-Hartman
2013-07-19 2:23 ` [ 03/18] USB: option,qcserial: move Novatel Gobi1K IDs to qcserial Greg Kroah-Hartman
2013-07-19 2:23 ` [ 04/18] usb: gadget: f_mass_storage: add missing memory barrier for thread_wakeup_needed Greg Kroah-Hartman
2013-07-19 2:23 ` [ 05/18] xhci: check for failed dma pool allocation Greg Kroah-Hartman
2013-07-19 2:23 ` [ 06/18] pcmcia: at91_cf: fix gpio_get_value in at91_cf_get_status Greg Kroah-Hartman
2013-07-19 2:23 ` [ 07/18] xen/time: remove blocked time accounting from xen "clockchip" Greg Kroah-Hartman
2013-07-19 2:23 ` [ 08/18] genirq: Fix can_request_irq() for IRQs without an action Greg Kroah-Hartman
2013-07-19 2:23 ` [ 09/18] drivers/rtc/rtc-rv3029c2.c: fix disabling AIE irq Greg Kroah-Hartman
2013-07-19 2:23 ` [ 10/18] ACPI / EC: Add HP Folio 13 to ec_dmi_table in order to skip DSDT scan Greg Kroah-Hartman
2013-07-22 16:13 ` Luis Henriques
2013-07-23 4:21 ` Ben Hutchings
2013-07-23 10:57 ` Rafael J. Wysocki
2013-07-23 10:57 ` Rafael J. Wysocki
2013-07-19 2:23 ` [ 11/18] ocfs2: xattr: fix inlined xattr reflink Greg Kroah-Hartman
2013-07-19 2:23 ` [ 12/18] ahci: Add AMD CZ SATA device ID Greg Kroah-Hartman
2013-07-19 2:23 ` [ 13/18] ahci: remove pmp link online check in FBS EH Greg Kroah-Hartman
2013-07-19 2:23 ` [ 14/18] timer: Fix jiffies wrap behavior of round_jiffies_common() Greg Kroah-Hartman
2013-07-19 2:23 ` Greg Kroah-Hartman [this message]
2013-07-19 2:23 ` [ 16/18] ext4: fix overflow when counting used blocks on 32-bit architectures Greg Kroah-Hartman
2013-07-19 2:23 ` [ 17/18] ARM: 7765/1: perf: Record the user-mode PC in the call chain Greg Kroah-Hartman
2013-07-19 2:23 ` [ 18/18] drivers/dma/pl330.c: fix locking in pl330_free_chan_resources() Greg Kroah-Hartman
2013-07-19 23:57 ` [ 00/18] 3.0.87-stable review Shuah Khan
2013-07-19 23:57 ` Shuah Khan
2013-07-21 2:02 ` Satoru Takeuchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130719021050.003259613@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jack@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.