diff mbox

[lucid/fsl-imx51,CVE,1/2] ext4: correctly calculate number of blocks for fiemap

Message ID 1317039014-19200-2-git-send-email-apw@canonical.com
State New
Headers show

Commit Message

Andy Whitcroft Sept. 26, 2011, 12:10 p.m. UTC 
From: Leonard Michlmayr <leonard.michlmayr@gmail.com>

BugLink: http://bugs.launchpad.net/bugs/583414
BugLink: http://bugs.launchpad.net/bugs/474597

commit aca92ff6f57c000d1b4523e383c8bd6b8269b8b1 upstream.

ext4_fiemap() rounds the length of the requested range down to
blocksize, which is is not the true number of blocks that cover the
requested region.  This problem is especially impressive if the user
requests only the first byte of a file: not a single extent will be
reported.

We fix this by calculating the last block of the region and then
subtract to find the number of blocks in the extents.

Signed-off-by: Leonard Michlmayr <leonard.michlmayr@gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Brad Figg <brad.figg@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

(cherry picked from commit c65f082ceb7f1c2ef5a1525adde15fc6a2712bf7)
CVE-2011-2695
BugLink: http://bugs.launchpad.net/bugs/819574
Signed-off-by: Andy Whitcroft <apw@canonical.com>
---
 fs/ext4/extents.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)
diff mbox

Patch

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 468c369..2ae21d1 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3689,7 +3689,6 @@  int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 		__u64 start, __u64 len)
 {
 	ext4_lblk_t start_blk;
-	ext4_lblk_t len_blks;
 	int error = 0;
 
 	/* fallback to generic here if not in extents fmt */
@@ -3703,8 +3702,14 @@  int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 	if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) {
 		error = ext4_xattr_fiemap(inode, fieinfo);
 	} else {
+		ext4_lblk_t len_blks;
+		__u64 last_blk;
+
 		start_blk = start >> inode->i_sb->s_blocksize_bits;
-		len_blks = len >> inode->i_sb->s_blocksize_bits;
+		last_blk = (start + len - 1) >> inode->i_sb->s_blocksize_bits;
+		if (last_blk >= EXT_MAX_BLOCK)
+			last_blk = EXT_MAX_BLOCK-1;
+		len_blks = ((ext4_lblk_t) last_blk) - start_blk + 1;
 
 		/*
 		 * Walk the extent tree gathering extent information.