ext4: Add sanity checks for the superblock before mounting the filesystem

[linux-2.6-omap-h63xx.git] / fs / ext4 / super.c

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 8ff8709828fd7b4c550d98ae5d51266d387f7ce8..517c90ad25bd793cfa9e965ea1c6a43b1cbab5dc 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2041,8 +2041,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
        const char *descr;
        int ret = -EINVAL;
        int blocksize;
-       int db_count;
-       int i;
+       unsigned int db_count;
+       unsigned int i;
        int needs_recovery, has_huge_files;
        int features;
        __u64 blocks_count;
@@ -2331,20 +2331,30 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
        if (EXT4_BLOCKS_PER_GROUP(sb) == 0)
                goto cantfind_ext4;
 
-       /* ensure blocks_count calculation below doesn't sign-extend */
-       if (ext4_blocks_count(es) + EXT4_BLOCKS_PER_GROUP(sb) <
-           le32_to_cpu(es->s_first_data_block) + 1) {
-               printk(KERN_WARNING "EXT4-fs: bad geometry: block count %llu, "
-                      "first data block %u, blocks per group %lu\n",
-                       ext4_blocks_count(es),
-                       le32_to_cpu(es->s_first_data_block),
-                       EXT4_BLOCKS_PER_GROUP(sb));
+        /*
+         * It makes no sense for the first data block to be beyond the end
+         * of the filesystem.
+         */
+        if (le32_to_cpu(es->s_first_data_block) >= ext4_blocks_count(es)) {
+                printk(KERN_WARNING "EXT4-fs: bad geometry: first data"
+                      "block %u is beyond end of filesystem (%llu)\n",
+                      le32_to_cpu(es->s_first_data_block),
+                      ext4_blocks_count(es));
                goto failed_mount;
        }
        blocks_count = (ext4_blocks_count(es) -
                        le32_to_cpu(es->s_first_data_block) +
                        EXT4_BLOCKS_PER_GROUP(sb) - 1);
        do_div(blocks_count, EXT4_BLOCKS_PER_GROUP(sb));
+       if (blocks_count > ((uint64_t)1<<32) - EXT4_DESC_PER_BLOCK(sb)) {
+               printk(KERN_WARNING "EXT4-fs: groups count too large: %u "
+                      "(block count %llu, first data block %u, "
+                      "blocks per group %lu)\n", sbi->s_groups_count,
+                      ext4_blocks_count(es),
+                      le32_to_cpu(es->s_first_data_block),
+                      EXT4_BLOCKS_PER_GROUP(sb));
+               goto failed_mount;
+       }
        sbi->s_groups_count = blocks_count;
        db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
                   EXT4_DESC_PER_BLOCK(sb);