Skip to content

Commit e880763

Browse files
ottingergjankara
authored andcommitted
ext2: fix datatype of block number in ext2_xattr_set2()
I run a small server that uses external hard drives for backups. The backup software I use uses ext2 filesystems with 4KiB block size and the server is running SELinux and therefore relies on xattr. I recently upgraded the hard drives from 4TB to 12TB models. I noticed that after transferring some TBs I got a filesystem error "Freeing blocks not in datazone - block = 18446744071529317386, count = 1" and the backup process stopped. Trying to fix the fs with e2fsck resulted in a completely corrupted fs. The error probably came from ext2_free_blocks(), and because of the large number 18e19 this problem immediately looked like some kind of integer overflow. Whereas the 4TB fs was about 1e9 blocks, the new 12TB is about 3e9 blocks. So, searching the ext2 code, I came across the line in fs/ext2/xattr.c:745 where ext2_new_block() is called and the resulting block number is stored in the variable block as an int datatype. If a block with a block number greater than INT32_MAX is returned, this variable overflows and the call to sb_getblk() at line fs/ext2/xattr.c:750 fails, then the call to ext2_free_blocks() produces the error. Signed-off-by: Georg Ottinger <g.ottinger@gmx.at> Signed-off-by: Jan Kara <jack@suse.cz> Message-Id: <20230815100340.22121-1-g.ottinger@gmx.at>
1 parent 5ae6ca2 commit e880763

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

fs/ext2/xattr.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -742,10 +742,10 @@ ext2_xattr_set2(struct inode *inode, struct buffer_head *old_bh,
742742
/* We need to allocate a new block */
743743
ext2_fsblk_t goal = ext2_group_first_block_no(sb,
744744
EXT2_I(inode)->i_block_group);
745-
int block = ext2_new_block(inode, goal, &error);
745+
ext2_fsblk_t block = ext2_new_block(inode, goal, &error);
746746
if (error)
747747
goto cleanup;
748-
ea_idebug(inode, "creating block %d", block);
748+
ea_idebug(inode, "creating block %lu", block);
749749

750750
new_bh = sb_getblk(sb, block);
751751
if (unlikely(!new_bh)) {

0 commit comments

Comments
 (0)