ldiskfs/kernel_patches/patches/ext3-16tb-overflow-fixes.patch

   1 Date: Tue, 19 Sep 2006 15:33:04 -0500
   2 From: Eric Sandeen <esandeen@redhat.com>
   3 Subject: [RHEL5 Patch 3/3] (resend) Fix ext3 32-bit inodes
   4
   5 This one is in the -mm tree as ext3-inode-numbers-are-unsigned-long.patch,
   6 resent to accomodate sct's request for uints instead; just pinged akpm
   7 to pick up the ulonglong->uint change.
   8
   9 This is primarily format string fixes, with changes to ialloc.c where large
  10 inode counts could overflow, and also pass around journal_inum as an
  11 unsigned long, just to be pedantic about it....
  12
  13 Signed-off-by: Eric Sandeen <esandeen@redhat.com>
  14 Cc: Mingming Cao <cmm@us.ibm.com>
  15 Signed-off-by: Andrew Morton <akpm@osdl.org>
  16
  17 Index: linux-2.6.17-1.2654.el5/fs/ext3/ialloc.c
  18 ===================================================================
  19 --- linux-2.6.17-1.2654.el5.orig/fs/ext3/ialloc.c
  20 +++ linux-2.6.17-1.2654.el5/fs/ext3/ialloc.c
  21 @@ -202,7 +202,7 @@ error_return:
  22  static int find_group_dir(struct super_block *sb, struct inode *parent)
  23  {
  24         int ngroups = EXT3_SB(sb)->s_groups_count;
  25 -       int freei, avefreei;
  26 +       unsigned int freei, avefreei;
  27         struct ext3_group_desc *desc, *best_desc = NULL;
  28         struct buffer_head *bh;
  29         int group, best_group = -1;
  30 @@ -261,10 +261,10 @@ static int find_group_orlov(struct super
  31         struct ext3_super_block *es = sbi->s_es;
  32         int ngroups = sbi->s_groups_count;
  33         int inodes_per_group = EXT3_INODES_PER_GROUP(sb);
  34 -       int freei, avefreei;
  35 +       unsigned int freei, avefreei;
  36         ext3_fsblk_t freeb, avefreeb;
  37         ext3_fsblk_t blocks_per_dir;
  38 -       int ndirs;
  39 +       unsigned int ndirs;
  40         int max_debt, max_dirs, min_inodes;
  41         ext3_grpblk_t min_blocks;
  42         int group = -1, i;
  43 Index: linux-2.6.17-1.2654.el5/fs/ext3/inode.c
  44 ===================================================================
  45 --- linux-2.6.17-1.2654.el5.orig/fs/ext3/inode.c
  46 +++ linux-2.6.17-1.2654.el5/fs/ext3/inode.c
  47 @@ -2115,7 +2115,7 @@ static void ext3_free_branches(handle_t
  48                          */
  49                         if (!bh) {
  50                                 ext3_error(inode->i_sb, "ext3_free_branches",
  51 -                                          "Read failure, inode=%ld, block="E3FSBLK,
  52 +                                          "Read failure, inode=%lu, block="E3FSBLK,
  53                                            inode->i_ino, nr);
  54                                 continue;
  55                         }
  56 Index: linux-2.6.17-1.2654.el5/fs/ext3/namei.c
  57 ===================================================================
  58 --- linux-2.6.17-1.2654.el5.orig/fs/ext3/namei.c
  59 +++ linux-2.6.17-1.2654.el5/fs/ext3/namei.c
  60 @@ -1919,8 +1919,8 @@ int ext3_orphan_add(handle_t *handle, st
  61         if (!err)
  62                 list_add(&EXT3_I(inode)->i_orphan, &EXT3_SB(sb)->s_orphan);
  63
  64 -       jbd_debug(4, "superblock will point to %ld\n", inode->i_ino);
  65 -       jbd_debug(4, "orphan inode %ld will point to %d\n",
  66 +       jbd_debug(4, "superblock will point to %lu\n", inode->i_ino);
  67 +       jbd_debug(4, "orphan inode %lu will point to %d\n",
  68                         inode->i_ino, NEXT_ORPHAN(inode));
  69  out_unlock:
  70         unlock_super(sb);
  71 Index: linux-2.6.17-1.2654.el5/fs/ext3/super.c
  72 ===================================================================
  73 --- linux-2.6.17-1.2654.el5.orig/fs/ext3/super.c
  74 +++ linux-2.6.17-1.2654.el5/fs/ext3/super.c
  75 @@ -45,7 +45,7 @@
  76  static int ext3_load_journal(struct super_block *, struct ext3_super_block *,
  77                              unsigned long journal_devnum);
  78  static int ext3_create_journal(struct super_block *, struct ext3_super_block *,
  79 -                              int);
  80 +                              unsigned int);
  81  static void ext3_commit_super (struct super_block * sb,
  82                                struct ext3_super_block * es,
  83                                int sync);
  84 @@ -376,7 +376,7 @@ static void dump_orphan_list(struct supe
  85         list_for_each(l, &sbi->s_orphan) {
  86                 struct inode *inode = orphan_list_entry(l);
  87                 printk(KERN_ERR "  "
  88 -                      "inode %s:%ld at %p: mode %o, nlink %d, next %d\n",
  89 +                      "inode %s:%lu at %p: mode %o, nlink %d, next %d\n",
  90                        inode->i_sb->s_id, inode->i_ino, inode,
  91                        inode->i_mode, inode->i_nlink,
  92                        NEXT_ORPHAN(inode));
  93 @@ -711,7 +711,7 @@ static ext3_fsblk_t get_sb_block(void **
  94  }
  95
  96  static int parse_options (char *options, struct super_block *sb,
  97 -                         unsigned long *inum, unsigned long *journal_devnum,
  98 +                         unsigned int *inum, unsigned long *journal_devnum,
  99                           ext3_fsblk_t *n_blocks_count, int is_remount)
 100  {
 101         struct ext3_sb_info *sbi = EXT3_SB(sb);
 102 @@ -1264,17 +1264,17 @@ static void ext3_orphan_cleanup (struct
 103                 DQUOT_INIT(inode);
 104                 if (inode->i_nlink) {
 105                         printk(KERN_DEBUG
 106 -                               "%s: truncating inode %ld to %Ld bytes\n",
 107 +                               "%s: truncating inode %lu to %Ld bytes\n",
 108                                 __FUNCTION__, inode->i_ino, inode->i_size);
 109 -                       jbd_debug(2, "truncating inode %ld to %Ld bytes\n",
 110 +                       jbd_debug(2, "truncating inode %lu to %Ld bytes\n",
 111                                   inode->i_ino, inode->i_size);
 112                         ext3_truncate(inode);
 113                         nr_truncates++;
 114                 } else {
 115                         printk(KERN_DEBUG
 116 -                               "%s: deleting unreferenced inode %ld\n",
 117 +                               "%s: deleting unreferenced inode %lu\n",
 118                                 __FUNCTION__, inode->i_ino);
 119 -                       jbd_debug(2, "deleting unreferenced inode %ld\n",
 120 +                       jbd_debug(2, "deleting unreferenced inode %lu\n",
 121                                   inode->i_ino);
 122                         nr_orphans++;
 123                 }
 124 @@ -1353,7 +1353,7 @@ static int ext3_fill_super (struct super
 125         ext3_fsblk_t sb_block = get_sb_block(&data);
 126         ext3_fsblk_t logic_sb_block;
 127         unsigned long offset = 0;
 128 -       unsigned long journal_inum = 0;
 129 +       unsigned int journal_inum = 0;
 130         unsigned long journal_devnum = 0;
 131         unsigned long def_mount_opts;
 132         struct inode *root;
 133 @@ -1802,7 +1802,8 @@ static void ext3_init_journal_params(str
 134         spin_unlock(&journal->j_state_lock);
 135  }
 136
 137 -static journal_t *ext3_get_journal(struct super_block *sb, int journal_inum)
 138 +static journal_t *ext3_get_journal(struct super_block *sb,
 139 +                                  unsigned int journal_inum)
 140  {
 141         struct inode *journal_inode;
 142         journal_t *journal;
 143 @@ -1937,7 +1938,7 @@ static int ext3_load_journal(struct supe
 144                              unsigned long journal_devnum)
 145  {
 146         journal_t *journal;
 147 -       int journal_inum = le32_to_cpu(es->s_journal_inum);
 148 +       unsigned int journal_inum = le32_to_cpu(es->s_journal_inum);
 149         dev_t journal_dev;
 150         int err = 0;
 151         int really_read_only;
 152 @@ -2023,7 +2024,7 @@ static int ext3_load_journal(struct supe
 153
 154  static int ext3_create_journal(struct super_block * sb,
 155                                struct ext3_super_block * es,
 156 -                              int journal_inum)
 157 +                              unsigned int journal_inum)
 158  {
 159         journal_t *journal;
 160
 161 @@ -2036,7 +2037,7 @@ static int ext3_create_journal(struct su
 162         if (!(journal = ext3_get_journal(sb, journal_inum)))
 163                 return -EINVAL;
 164
 165 -       printk(KERN_INFO "EXT3-fs: creating new journal on inode %d\n",
 166 +       printk(KERN_INFO "EXT3-fs: creating new journal on inode %u\n",
 167                journal_inum);
 168
 169         if (journal_create(journal)) {
 170 Index: linux-2.6.17-1.2654.el5/fs/ext3/xattr.c
 171 ===================================================================
 172 --- linux-2.6.17-1.2654.el5.orig/fs/ext3/xattr.c
 173 +++ linux-2.6.17-1.2654.el5/fs/ext3/xattr.c
 174 @@ -75,7 +75,7 @@
 175
 176  #ifdef EXT3_XATTR_DEBUG
 177  # define ea_idebug(inode, f...) do { \
 178 -               printk(KERN_DEBUG "inode %s:%ld: ", \
 179 +               printk(KERN_DEBUG "inode %s:%lu: ", \
 180                         inode->i_sb->s_id, inode->i_ino); \
 181                 printk(f); \
 182                 printk("\n"); \
 183 @@ -233,7 +233,7 @@ ext3_xattr_block_get(struct inode *inode
 184                 atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
 185         if (ext3_xattr_check_block(bh)) {
 186  bad_block:     ext3_error(inode->i_sb, __FUNCTION__,
 187 -                          "inode %ld: bad block "E3FSBLK, inode->i_ino,
 188 +                          "inode %lu: bad block "E3FSBLK, inode->i_ino,
 189                            EXT3_I(inode)->i_file_acl);
 190                 error = -EIO;
 191                 goto cleanup;
 192 @@ -375,7 +375,7 @@ ext3_xattr_block_list(struct inode *inod
 193                 atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
 194         if (ext3_xattr_check_block(bh)) {
 195                 ext3_error(inode->i_sb, __FUNCTION__,
 196 -                          "inode %ld: bad block "E3FSBLK, inode->i_ino,
 197 +                          "inode %lu: bad block "E3FSBLK, inode->i_ino,
 198                            EXT3_I(inode)->i_file_acl);
 199                 error = -EIO;
 200                 goto cleanup;
 201 @@ -647,7 +647,7 @@ ext3_xattr_block_find(struct inode *inod
 202                         le32_to_cpu(BHDR(bs->bh)->h_refcount));
 203                 if (ext3_xattr_check_block(bs->bh)) {
 204                         ext3_error(sb, __FUNCTION__,
 205 -                               "inode %ld: bad block "E3FSBLK, inode->i_ino,
 206 +                               "inode %lu: bad block "E3FSBLK, inode->i_ino,
 207                                 EXT3_I(inode)->i_file_acl);
 208                         error = -EIO;
 209                         goto cleanup;
 210 @@ -848,7 +848,7 @@ cleanup_dquot:
 211
 212  bad_block:
 213         ext3_error(inode->i_sb, __FUNCTION__,
 214 -                  "inode %ld: bad block "E3FSBLK, inode->i_ino,
 215 +                  "inode %lu: bad block "E3FSBLK, inode->i_ino,
 216                    EXT3_I(inode)->i_file_acl);
 217         goto cleanup;
 218
 219 @@ -1077,14 +1077,14 @@ ext3_xattr_delete_inode(handle_t *handle
 220         bh = sb_bread(inode->i_sb, EXT3_I(inode)->i_file_acl);
 221         if (!bh) {
 222                 ext3_error(inode->i_sb, __FUNCTION__,
 223 -                       "inode %ld: block "E3FSBLK" read error", inode->i_ino,
 224 +                       "inode %lu: block "E3FSBLK" read error", inode->i_ino,
 225                         EXT3_I(inode)->i_file_acl);
 226                 goto cleanup;
 227         }
 228         if (BHDR(bh)->h_magic != cpu_to_le32(EXT3_XATTR_MAGIC) ||
 229             BHDR(bh)->h_blocks != cpu_to_le32(1)) {
 230                 ext3_error(inode->i_sb, __FUNCTION__,
 231 -                       "inode %ld: bad block "E3FSBLK, inode->i_ino,
 232 +                       "inode %lu: bad block "E3FSBLK, inode->i_ino,
 233                         EXT3_I(inode)->i_file_acl);
 234                 goto cleanup;
 235         }
 236 @@ -1211,7 +1211,7 @@ again:
 237                 bh = sb_bread(inode->i_sb, ce->e_block);
 238                 if (!bh) {
 239                         ext3_error(inode->i_sb, __FUNCTION__,
 240 -                               "inode %ld: block %lu read error",
 241 +                               "inode %lu: block %lu read error",
 242                                 inode->i_ino, (unsigned long) ce->e_block);
 243                 } else if (le32_to_cpu(BHDR(bh)->h_refcount) >=
 244                                 EXT3_XATTR_REFCOUNT_MAX) {
 245
 246 Date: Tue, 19 Sep 2006 15:32:02 -0500
 247 From: Eric Sandeen <esandeen@redhat.com>
 248 Subject: [RHEL5 Patch 1/3] (resend) Fix ext3 overflows at 16T
 249
 250 This one is in -mm as fix-ext3-mounts-at-16t.patch and
 251 fix-ext3-mounts-at-16t-fix.patch
 252
 253 this gets things mounting for a 16T ext3 filesystem.  (patched up
 254 e2fsprogs will be needed too, working on that)
 255
 256 jarod wilson has been helping with testing.
 257
 258 This patch fixes these issues in the kernel:
 259
 260 o sbi->s_groups_count overflows in ext3_fill_super()
 261
 262         sbi->s_groups_count = (le32_to_cpu(es->s_blocks_count) -
 263                                le32_to_cpu(es->s_first_data_block) +
 264                                EXT3_BLOCKS_PER_GROUP(sb) - 1) /
 265                               EXT3_BLOCKS_PER_GROUP(sb);
 266
 267   at 16T, s_blocks_count is already maxed out; adding
 268   EXT3_BLOCKS_PER_GROUP(sb) overflows it and groups_count comes out to 0.
 269   Not really what we want, and causes a failed mount.
 270
 271   Changing it this way works & avoids the overflow:
 272
 273   (A + B - 1)/B changed to: ((A - 1)/B) + 1
 274
 275 o ext3_check_descriptors() overflows range checks
 276
 277   ext3_check_descriptors() iterates over all block groups making sure
 278   that various bits are within the right block ranges...  on the last pass
 279   through, it is checking the error case
 280
 281    [item] >= block + EXT3_BLOCKS_PER_GROUP(sb)
 282
 283   where "block" is the first block in the last block group.  The last
 284   block in this group (and the last one that will fit in 32 bits) is block
 285   + EXT3_BLOCKS_PER_GROUP(sb)- 1.  block + EXT3_BLOCKS_PER_GROUP(sb) wraps
 286   back around to 0.
 287
 288   so, make things clearer with "first_block" and "last_block" where those
 289   are first and last, inclusive, and use <, > rather than <, >=.
 290
 291   Finally, the last block group may be smaller than the rest, so account
 292   for this on the last pass through: last_block = sb->s_blocks_count - 1;
 293
 294 Signed-off-by: Eric Sandeen <esandeen@redhat.com>
 295 Cc: Mingming Cao <cmm@us.ibm.com>
 296 Signed-off-by: Andrew Morton <akpm@osdl.org>
 297
 298 Index: linux-2.6.17-1.2654.el5/fs/ext3/super.c
 299 ===================================================================
 300 --- linux-2.6.17-1.2654.el5.orig/fs/ext3/super.c
 301 +++ linux-2.6.17-1.2654.el5/fs/ext3/super.c
 302 @@ -1132,7 +1132,8 @@ static int ext3_setup_super(struct super
 303  static int ext3_check_descriptors (struct super_block * sb)
 304  {
 305         struct ext3_sb_info *sbi = EXT3_SB(sb);
 306 -       ext3_fsblk_t block = le32_to_cpu(sbi->s_es->s_first_data_block);
 307 +       ext3_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
 308 +       ext3_fsblk_t last_block;
 309         struct ext3_group_desc * gdp = NULL;
 310         int desc_block = 0;
 311         int i;
 312 @@ -1141,12 +1142,17 @@ static int ext3_check_descriptors (struc
 313
 314         for (i = 0; i < sbi->s_groups_count; i++)
 315         {
 316 +               if (i == sbi->s_groups_count - 1)
 317 +                       last_block = le32_to_cpu(sbi->s_es->s_blocks_count) - 1;
 318 +               else
 319 +                       last_block = first_block +
 320 +                               (EXT3_BLOCKS_PER_GROUP(sb) - 1);
 321 +
 322                 if ((i % EXT3_DESC_PER_BLOCK(sb)) == 0)
 323                         gdp = (struct ext3_group_desc *)
 324                                         sbi->s_group_desc[desc_block++]->b_data;
 325 -               if (le32_to_cpu(gdp->bg_block_bitmap) < block ||
 326 -                   le32_to_cpu(gdp->bg_block_bitmap) >=
 327 -                               block + EXT3_BLOCKS_PER_GROUP(sb))
 328 +               if (le32_to_cpu(gdp->bg_block_bitmap) < first_block ||
 329 +                   le32_to_cpu(gdp->bg_block_bitmap) > last_block)
 330                 {
 331                         ext3_error (sb, "ext3_check_descriptors",
 332                                     "Block bitmap for group %d"
 333 @@ -1155,9 +1161,8 @@ static int ext3_check_descriptors (struc
 334                                         le32_to_cpu(gdp->bg_block_bitmap));
 335                         return 0;
 336                 }
 337 -               if (le32_to_cpu(gdp->bg_inode_bitmap) < block ||
 338 -                   le32_to_cpu(gdp->bg_inode_bitmap) >=
 339 -                               block + EXT3_BLOCKS_PER_GROUP(sb))
 340 +               if (le32_to_cpu(gdp->bg_inode_bitmap) < first_block ||
 341 +                   le32_to_cpu(gdp->bg_inode_bitmap) > last_block)
 342                 {
 343                         ext3_error (sb, "ext3_check_descriptors",
 344                                     "Inode bitmap for group %d"
 345 @@ -1166,9 +1171,9 @@ static int ext3_check_descriptors (struc
 346                                         le32_to_cpu(gdp->bg_inode_bitmap));
 347                         return 0;
 348                 }
 349 -               if (le32_to_cpu(gdp->bg_inode_table) < block ||
 350 -                   le32_to_cpu(gdp->bg_inode_table) + sbi->s_itb_per_group >=
 351 -                   block + EXT3_BLOCKS_PER_GROUP(sb))
 352 +               if (le32_to_cpu(gdp->bg_inode_table) < first_block ||
 353 +                   le32_to_cpu(gdp->bg_inode_table) + sbi->s_itb_per_group >
 354 +                   last_block)
 355                 {
 356                         ext3_error (sb, "ext3_check_descriptors",
 357                                     "Inode table for group %d"
 358 @@ -1177,7 +1182,7 @@ static int ext3_check_descriptors (struc
 359                                         le32_to_cpu(gdp->bg_inode_table));
 360                         return 0;
 361                 }
 362 -               block += EXT3_BLOCKS_PER_GROUP(sb);
 363 +               first_block += EXT3_BLOCKS_PER_GROUP(sb);
 364                 gdp++;
 365         }
 366
 367 @@ -1580,10 +1585,9 @@ static int ext3_fill_super (struct super
 368
 369         if (EXT3_BLOCKS_PER_GROUP(sb) == 0)
 370                 goto cantfind_ext3;
 371 -       sbi->s_groups_count = (le32_to_cpu(es->s_blocks_count) -
 372 -                              le32_to_cpu(es->s_first_data_block) +
 373 -                              EXT3_BLOCKS_PER_GROUP(sb) - 1) /
 374 -                             EXT3_BLOCKS_PER_GROUP(sb);
 375 +       sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
 376 +                              le32_to_cpu(es->s_first_data_block) - 1)
 377 +                                      / EXT3_BLOCKS_PER_GROUP(sb)) + 1;
 378         db_count = (sbi->s_groups_count + EXT3_DESC_PER_BLOCK(sb) - 1) /
 379                    EXT3_DESC_PER_BLOCK(sb);
 380         sbi->s_group_desc = kmalloc(db_count * sizeof (struct buffer_head *),
 381
 382 Date: Tue, 19 Sep 2006 15:32:42 -0500
 383 From: Eric Sandeen <esandeen@redhat.com>
 384 Subject: [RHEL5 Patch 2/3] (resend) Fix more ext3 overflows at 16T
 385
 386 This is in akpm's tree as
 387 more-ext3-16t-overflow-fixes.patch and more-ext3-16t-overflow-fixes-fix.patch
 388
 389 Some of the changes in balloc.c are just cosmetic -
 390 if they overflow they'll then underflow and things are fine.
 391
 392 5th hunk actually fixes an overflow problem.
 393
 394 Also check for potential overflows in inode & block counts when resizing.
 395
 396 Signed-off-by: Eric Sandeen <esandeen@redhat.com>
 397 Cc: Mingming Cao <cmm@us.ibm.com>
 398 Signed-off-by: Andrew Morton <akpm@osdl.org>
 399
 400 Index: linux-2.6.17-1.2654.el5/fs/ext3/balloc.c
 401 ===================================================================
 402 --- linux-2.6.17-1.2654.el5.orig/fs/ext3/balloc.c
 403 +++ linux-2.6.17-1.2654.el5/fs/ext3/balloc.c
 404 @@ -168,7 +168,7 @@ goal_in_my_reservation(struct ext3_reser
 405         ext3_fsblk_t group_first_block, group_last_block;
 406
 407         group_first_block = ext3_group_first_block_no(sb, group);
 408 -       group_last_block = group_first_block + EXT3_BLOCKS_PER_GROUP(sb) - 1;
 409 +       group_last_block = group_first_block + (EXT3_BLOCKS_PER_GROUP(sb) - 1);
 410
 411         if ((rsv->_rsv_start > group_last_block) ||
 412             (rsv->_rsv_end < group_first_block))
 413 @@ -897,7 +897,7 @@ static int alloc_new_reservation(struct
 414         spinlock_t *rsv_lock = &EXT3_SB(sb)->s_rsv_window_lock;
 415
 416         group_first_block = ext3_group_first_block_no(sb, group);
 417 -       group_end_block = group_first_block + EXT3_BLOCKS_PER_GROUP(sb) - 1;
 418 +       group_end_block = group_first_block + (EXT3_BLOCKS_PER_GROUP(sb) - 1);
 419
 420         if (grp_goal < 0)
 421                 start_block = group_first_block;
 422 @@ -1063,7 +1063,7 @@ ext3_try_to_allocate_with_rsv(struct sup
 423                         struct ext3_reserve_window_node * my_rsv,
 424                         unsigned long *count, int *errp)
 425  {
 426 -       ext3_fsblk_t group_first_block;
 427 +       ext3_fsblk_t group_first_block, group_last_block;
 428         ext3_grpblk_t ret = 0;
 429         int fatal;
 430         unsigned long num = *count;
 431 @@ -1100,6 +1100,7 @@ ext3_try_to_allocate_with_rsv(struct sup
 432          * first block is the block number of the first block in this group
 433          */
 434         group_first_block = ext3_group_first_block_no(sb, group);
 435 +       group_last_block = group_first_block + (EXT3_BLOCKS_PER_GROUP(sb) - 1);
 436
 437         /*
 438          * Basically we will allocate a new block from inode's reservation
 439 @@ -1132,8 +1133,8 @@ ext3_try_to_allocate_with_rsv(struct sup
 440                         try_to_extend_reservation(my_rsv, sb,
 441                                         *count-my_rsv->rsv_end + grp_goal - 1);
 442
 443 -               if ((my_rsv->rsv_start >= group_first_block + EXT3_BLOCKS_PER_GROUP(sb))
 444 -                   || (my_rsv->rsv_end < group_first_block))
 445 +               if ((my_rsv->rsv_start > group_last_block) ||
 446 +                               (my_rsv->rsv_end < group_first_block))
 447                         BUG();
 448                 ret = ext3_try_to_allocate(sb, handle, group, bitmap_bh, grp_goal,
 449                                            &num, &my_rsv->rsv_window);
 450 Index: linux-2.6.17-1.2654.el5/fs/ext3/resize.c
 451 ===================================================================
 452 --- linux-2.6.17-1.2654.el5.orig/fs/ext3/resize.c
 453 +++ linux-2.6.17-1.2654.el5/fs/ext3/resize.c
 454 @@ -730,6 +730,18 @@ int ext3_group_add(struct super_block *s
 455                 return -EPERM;
 456         }
 457
 458 +       if (le32_to_cpu(es->s_blocks_count) + input->blocks_count <
 459 +           le32_to_cpu(es->s_blocks_count)) {
 460 +               ext3_warning(sb, __FUNCTION__, "blocks_count overflow\n");
 461 +               return -EINVAL;
 462 +       }
 463 +
 464 +       if (le32_to_cpu(es->s_inodes_count) + EXT3_INODES_PER_GROUP(sb) <
 465 +           le32_to_cpu(es->s_inodes_count)) {
 466 +               ext3_warning(sb, __FUNCTION__, "inodes_count overflow\n");
 467 +               return -EINVAL;
 468 +       }
 469 +
 470         if (reserved_gdb || gdb_off == 0) {
 471                 if (!EXT3_HAS_COMPAT_FEATURE(sb,
 472                                              EXT3_FEATURE_COMPAT_RESIZE_INODE)){
 473 @@ -958,6 +970,11 @@ int ext3_group_extend(struct super_block
 474
 475         add = EXT3_BLOCKS_PER_GROUP(sb) - last;
 476
 477 +       if (o_blocks_count + add < o_blocks_count) {
 478 +               ext3_warning(sb, __FUNCTION__, "blocks_count overflow");
 479 +               return -EINVAL;
 480 +       }
 481 +
 482         if (o_blocks_count + add > n_blocks_count)
 483                 add = n_blocks_count - o_blocks_count;
 484