1 files changed, 30 insertions, 12 deletions

diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 5e1337fd878a..b73cba12f79c 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -336,7 +336,7 @@ static int verify_reserved_gdb(struct super_block *sb,
         unsigned five = 5;
         unsigned seven = 7;
         unsigned grp;
-        __u32 *p = (__u32 *)primary->b_data;
+        __le32 *p = (__le32 *)primary->b_data;
         int gdbackups = 0;
 
         while ((grp = ext3_list_backups(sb, &three, &five, &seven)) < end) {
@@ -380,7 +380,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
         struct buffer_head *dind;
         int gdbackups;
         struct ext3_iloc iloc;
-        __u32 *data;
+        __le32 *data;
         int err;
 
         if (test_opt(sb, DEBUG))
@@ -417,7 +417,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
                 goto exit_bh;
         }
 
-        data = (__u32 *)dind->b_data;
+        data = (__le32 *)dind->b_data;
         if (le32_to_cpu(data[gdb_num % EXT3_ADDR_PER_BLOCK(sb)]) != gdblock) {
                 ext3_warning(sb, __FUNCTION__,
                              "new group %u GDT block "E3FSBLK" not reserved",
@@ -439,8 +439,8 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
         if ((err = ext3_reserve_inode_write(handle, inode, &iloc)))
                 goto exit_dindj;
 
-        n_group_desc = (struct buffer_head **)kmalloc((gdb_num + 1) *
-                                sizeof(struct buffer_head *), GFP_KERNEL);
+        n_group_desc = kmalloc((gdb_num + 1) * sizeof(struct buffer_head *),
+                        GFP_KERNEL);
         if (!n_group_desc) {
                 err = -ENOMEM;
                 ext3_warning (sb, __FUNCTION__,
@@ -519,7 +519,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
         struct buffer_head *dind;
         struct ext3_iloc iloc;
         ext3_fsblk_t blk;
-        __u32 *data, *end;
+        __le32 *data, *end;
         int gdbackups = 0;
         int res, i;
         int err;
@@ -536,8 +536,8 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
         }
 
         blk = EXT3_SB(sb)->s_sbh->b_blocknr + 1 + EXT3_SB(sb)->s_gdb_count;
-        data = (__u32 *)dind->b_data + EXT3_SB(sb)->s_gdb_count;
-        end = (__u32 *)dind->b_data + EXT3_ADDR_PER_BLOCK(sb);
+        data = (__le32 *)dind->b_data + EXT3_SB(sb)->s_gdb_count;
+        end = (__le32 *)dind->b_data + EXT3_ADDR_PER_BLOCK(sb);
 
         /* Get each reserved primary GDT block and verify it holds backups */
         for (res = 0; res < reserved_gdb; res++, blk++) {
@@ -545,7 +545,8 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
                         ext3_warning(sb, __FUNCTION__,
                                      "reserved block "E3FSBLK
                                      " not at offset %ld",
-                                     blk, (long)(data - (__u32 *)dind->b_data));
+                                     blk,
+                                     (long)(data - (__le32 *)dind->b_data));
                         err = -EINVAL;
                         goto exit_bh;
                 }
@@ -560,7 +561,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
                         goto exit_bh;
                 }
                 if (++data >= end)
-                        data = (__u32 *)dind->b_data;
+                        data = (__le32 *)dind->b_data;
         }
 
         for (i = 0; i < reserved_gdb; i++) {
@@ -584,7 +585,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
         blk = input->group * EXT3_BLOCKS_PER_GROUP(sb);
         for (i = 0; i < reserved_gdb; i++) {
                 int err2;
-                data = (__u32 *)primary[i]->b_data;
+                data = (__le32 *)primary[i]->b_data;
                 /* printk("reserving backup %lu[%u] = %lu\n",
                        primary[i]->b_blocknr, gdbackups,
                        blk + primary[i]->b_blocknr); */
@@ -689,7 +690,7 @@ exit_err:
                              "can't update backup for group %d (err %d), "
                              "forcing fsck on next reboot", group, err);
                 sbi->s_mount_state &= ~EXT3_VALID_FS;
-                sbi->s_es->s_state &= ~cpu_to_le16(EXT3_VALID_FS);
+                sbi->s_es->s_state &= cpu_to_le16(~EXT3_VALID_FS);
                 mark_buffer_dirty(sbi->s_sbh);
         }
 }
@@ -730,6 +731,18 @@ int ext3_group_add(struct super_block *sb, struct ext3_new_group_data *input)
                 return -EPERM;
         }
 
+        if (le32_to_cpu(es->s_blocks_count) + input->blocks_count <
+            le32_to_cpu(es->s_blocks_count)) {
+                ext3_warning(sb, __FUNCTION__, "blocks_count overflow\n");
+                return -EINVAL;
+        }
+
+        if (le32_to_cpu(es->s_inodes_count) + EXT3_INODES_PER_GROUP(sb) <
+            le32_to_cpu(es->s_inodes_count)) {
+                ext3_warning(sb, __FUNCTION__, "inodes_count overflow\n");
+                return -EINVAL;
+        }
+
         if (reserved_gdb || gdb_off == 0) {
                 if (!EXT3_HAS_COMPAT_FEATURE(sb,
                                              EXT3_FEATURE_COMPAT_RESIZE_INODE)){
@@ -958,6 +971,11 @@ int ext3_group_extend(struct super_block *sb, struct ext3_super_block *es,
 
         add = EXT3_BLOCKS_PER_GROUP(sb) - last;
 
+        if (o_blocks_count + add < o_blocks_count) {
+                ext3_warning(sb, __FUNCTION__, "blocks_count overflow");
+                return -EINVAL;
+        }
+
         if (o_blocks_count + add > n_blocks_count)
                 add = n_blocks_count - o_blocks_count;