3.18-stable patches

added patches:
	ext4-fix-overflow-caused-by-missing-cast-in-ext4_resize_fs.patch
	ext4-fix-seek_hole-seek_data-for-blocksize-pagesize.patch

diff --git a/queue-3.18/ext4-fix-overflow-caused-by-missing-cast-in-ext4_resize_fs.patch b/queue-3.18/ext4-fix-overflow-caused-by-missing-cast-in-ext4_resize_fs.patch
new file mode 100644 (file)
index 0000000..5644364
--- /dev/null
+++ b/queue-3.18/ext4-fix-overflow-caused-by-missing-cast-in-ext4_resize_fs.patch
@@ -0,0 +1,34 @@
+From aec51758ce10a9c847a62a48a168f8c804c6e053 Mon Sep 17 00:00:00 2001
+From: Jerry Lee <jerrylee@qnap.com>
+Date: Sun, 6 Aug 2017 01:18:31 -0400
+Subject: ext4: fix overflow caused by missing cast in ext4_resize_fs()
+
+From: Jerry Lee <jerrylee@qnap.com>
+
+commit aec51758ce10a9c847a62a48a168f8c804c6e053 upstream.
+
+On a 32-bit platform, the value of n_blcoks_count may be wrong during
+the file system is resized to size larger than 2^32 blocks.  This may
+caused the superblock being corrupted with zero blocks count.
+
+Fixes: 1c6bd7173d66
+Signed-off-by: Jerry Lee <jerrylee@qnap.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/resize.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1929,7 +1929,8 @@ retry:
+                       n_desc_blocks = o_desc_blocks +
+                               le16_to_cpu(es->s_reserved_gdt_blocks);
+                       n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb);
+-                      n_blocks_count = n_group * EXT4_BLOCKS_PER_GROUP(sb);
++                      n_blocks_count = (ext4_fsblk_t)n_group *
++                              EXT4_BLOCKS_PER_GROUP(sb);
+                       n_group--; /* set to last group number */
+               }
+ 

diff --git a/queue-3.18/ext4-fix-seek_hole-seek_data-for-blocksize-pagesize.patch b/queue-3.18/ext4-fix-seek_hole-seek_data-for-blocksize-pagesize.patch
new file mode 100644 (file)
index 0000000..5dc8096
--- /dev/null
+++ b/queue-3.18/ext4-fix-seek_hole-seek_data-for-blocksize-pagesize.patch
@@ -0,0 +1,51 @@
+From fcf5ea10992fbac3c7473a1db33d56a139333cd1 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 5 Aug 2017 17:43:24 -0400
+Subject: ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
+
+From: Jan Kara <jack@suse.cz>
+
+commit fcf5ea10992fbac3c7473a1db33d56a139333cd1 upstream.
+
+ext4_find_unwritten_pgoff() does not properly handle a situation when
+starting index is in the middle of a page and blocksize < pagesize. The
+following command shows the bug on filesystem with 1k blocksize:
+
+  xfs_io -f -c "falloc 0 4k" \
+            -c "pwrite 1k 1k" \
+            -c "pwrite 3k 1k" \
+            -c "seek -a -r 0" foo
+
+In this example, neither lseek(fd, 1024, SEEK_HOLE) nor lseek(fd, 2048,
+SEEK_DATA) will return the correct result.
+
+Fix the problem by neglecting buffers in a page before starting offset.
+
+Reported-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/file.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -340,6 +340,8 @@ static int ext4_find_unwritten_pgoff(str
+                               lastoff = page_offset(page);
+                               bh = head = page_buffers(page);
+                               do {
++                                      if (lastoff + bh->b_size <= startoff)
++                                              goto next;
+                                       if (buffer_uptodate(bh) ||
+                                           buffer_unwritten(bh)) {
+                                               if (whence == SEEK_DATA)
+@@ -354,6 +356,7 @@ static int ext4_find_unwritten_pgoff(str
+                                               unlock_page(page);
+                                               goto out;
+                                       }
++next:
+                                       lastoff += bh->b_size;
+                                       bh = bh->b_this_page;
+                               } while (bh != head);

diff --git a/queue-3.18/series b/queue-3.18/series
index b8aeda74df582f0f5d62d0819821fbf378cb5382..16b35787bed56efad5480662323c8ca013749ed5 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -59,3 +59,5 @@ alsa-hda-fix-speaker-output-from-vaio-vpcl14m1r.patch
 asoc-do-not-close-shared-backend-dailink.patch
 kvm-async_pf-make-rcu-irq-exit-if-not-triggered-from-idle-task.patch
 mm-page_alloc-remove-kernel-address-exposure-in-free_reserved_area.patch
+ext4-fix-seek_hole-seek_data-for-blocksize-pagesize.patch
+ext4-fix-overflow-caused-by-missing-cast-in-ext4_resize_fs.patch