[lucid/fsl-imx51 CVE 1/2] ext4: correctly calculate number of blocks for fiemap

[Andy Whitcroft]

From: Leonard Michlmayr <leonard.michlmayr at gmail.com>

BugLink: http://bugs.launchpad.net/bugs/583414
BugLink: http://bugs.launchpad.net/bugs/474597

commit aca92ff6f57c000d1b4523e383c8bd6b8269b8b1 upstream.

ext4_fiemap() rounds the length of the requested range down to
blocksize, which is is not the true number of blocks that cover the
requested region.  This problem is especially impressive if the user
requests only the first byte of a file: not a single extent will be
reported.

We fix this by calculating the last block of the region and then
subtract to find the number of blocks in the extents.

Signed-off-by: Leonard Michlmayr <leonard.michlmayr at gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
Acked-by: Stefan Bader <stefan.bader at canonical.com>
Acked-by: Brad Figg <brad.figg at canonical.com>
Signed-off-by: Stefan Bader <stefan.bader at canonical.com>

(cherry picked from commit c65f082ceb7f1c2ef5a1525adde15fc6a2712bf7)
CVE-2011-2695
BugLink: http://bugs.launchpad.net/bugs/819574
Signed-off-by: Andy Whitcroft <apw at canonical.com>
---
 fs/ext4/extents.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 468c369..2ae21d1 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3689,7 +3689,6 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 		__u64 start, __u64 len)
 {
 	ext4_lblk_t start_blk;
-	ext4_lblk_t len_blks;
 	int error = 0;
 
 	/* fallback to generic here if not in extents fmt */
@@ -3703,8 +3702,14 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 	if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) {
 		error = ext4_xattr_fiemap(inode, fieinfo);
 	} else {
+		ext4_lblk_t len_blks;
+		__u64 last_blk;
+
 		start_blk = start >> inode->i_sb->s_blocksize_bits;
-		len_blks = len >> inode->i_sb->s_blocksize_bits;
+		last_blk = (start + len - 1) >> inode->i_sb->s_blocksize_bits;
+		if (last_blk >= EXT_MAX_BLOCK)
+			last_blk = EXT_MAX_BLOCK-1;
+		len_blks = ((ext4_lblk_t) last_blk) - start_blk + 1;
 
 		/*
 		 * Walk the extent tree gathering extent information.
-- 
1.7.4.1