From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7EC9EEEB569 for ; Fri, 8 Sep 2023 19:33:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237294AbjIHTdC (ORCPT ); Fri, 8 Sep 2023 15:33:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48566 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229699AbjIHTcy (ORCPT ); Fri, 8 Sep 2023 15:32:54 -0400 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AA2A0CCA; Fri, 8 Sep 2023 12:32:29 -0700 (PDT) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4E8F6C433C9; Fri, 8 Sep 2023 19:31:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1694201500; bh=2ymu0h75QDYuoxIwmPdn9W2smvr5mgfdmUUoX3TZl0g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gmwhtZFHFLvW6PBelhEO7sO7l2MoQrJM9xvJRf+/2rSFRNNW+1xKPLhANM06CYXS9 r4al7jfeZTXYiJnhCusZ8gVgjlINJ5kuUfS5MDJv6N/vcDSBLb9nIFrlVLxVliVuFY WmP5c+wJgETnP1DIjLSfYHfbbEcqVeNrSOe7EYEuO7lBVqeI6qK/NpPg4IJEp4alT2 vYIWtcrCuEk6+pkLuPW4bCx2Hm/l9NvYSkMVDoc7zqV7QKw/N9m/8viShLQcsxdNnv YDzGnfwxOeaJdcsWMdjAazO2kVecOKmaGtqqiCye/VwYZzzo3jDilvPHp+Jsi9esXD rPETNXo7+FmUw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Georg Ottinger , Jan Kara , Sasha Levin , jack@suse.com, linux-ext4@vger.kernel.org Subject: [PATCH AUTOSEL 6.5 33/36] ext2: fix datatype of block number in ext2_xattr_set2() Date: Fri, 8 Sep 2023 15:28:44 -0400 Message-Id: <20230908192848.3462476-33-sashal@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230908192848.3462476-1-sashal@kernel.org> References: <20230908192848.3462476-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.5.2 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Georg Ottinger [ Upstream commit e88076348425b7d0491c8c98d8732a7df8de7aa3 ] I run a small server that uses external hard drives for backups. The backup software I use uses ext2 filesystems with 4KiB block size and the server is running SELinux and therefore relies on xattr. I recently upgraded the hard drives from 4TB to 12TB models. I noticed that after transferring some TBs I got a filesystem error "Freeing blocks not in datazone - block = 18446744071529317386, count = 1" and the backup process stopped. Trying to fix the fs with e2fsck resulted in a completely corrupted fs. The error probably came from ext2_free_blocks(), and because of the large number 18e19 this problem immediately looked like some kind of integer overflow. Whereas the 4TB fs was about 1e9 blocks, the new 12TB is about 3e9 blocks. So, searching the ext2 code, I came across the line in fs/ext2/xattr.c:745 where ext2_new_block() is called and the resulting block number is stored in the variable block as an int datatype. If a block with a block number greater than INT32_MAX is returned, this variable overflows and the call to sb_getblk() at line fs/ext2/xattr.c:750 fails, then the call to ext2_free_blocks() produces the error. Signed-off-by: Georg Ottinger Signed-off-by: Jan Kara Message-Id: <20230815100340.22121-1-g.ottinger@gmx.at> Signed-off-by: Sasha Levin --- fs/ext2/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c index 8906ba479aafb..89517937d36c4 100644 --- a/fs/ext2/xattr.c +++ b/fs/ext2/xattr.c @@ -742,10 +742,10 @@ ext2_xattr_set2(struct inode *inode, struct buffer_head *old_bh, /* We need to allocate a new block */ ext2_fsblk_t goal = ext2_group_first_block_no(sb, EXT2_I(inode)->i_block_group); - int block = ext2_new_block(inode, goal, &error); + ext2_fsblk_t block = ext2_new_block(inode, goal, &error); if (error) goto cleanup; - ea_idebug(inode, "creating block %d", block); + ea_idebug(inode, "creating block %lu", block); new_bh = sb_getblk(sb, block); if (unlikely(!new_bh)) { -- 2.40.1