1 files changed, 20 insertions, 10 deletions

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 8ff8709828fd..517c90ad25bd 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2041,8 +2041,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         const char *descr;
         int ret = -EINVAL;
         int blocksize;
-        int db_count;
-        int i;
+        unsigned int db_count;
+        unsigned int i;
         int needs_recovery, has_huge_files;
         int features;
         __u64 blocks_count;
@@ -2331,20 +2331,30 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         if (EXT4_BLOCKS_PER_GROUP(sb) == 0)
                 goto cantfind_ext4;
 
-        /* ensure blocks_count calculation below doesn't sign-extend */
-        if (ext4_blocks_count(es) + EXT4_BLOCKS_PER_GROUP(sb) <
-            le32_to_cpu(es->s_first_data_block) + 1) {
-                printk(KERN_WARNING "EXT4-fs: bad geometry: block count %llu, "
-                       "first data block %u, blocks per group %lu\n",
-                        ext4_blocks_count(es),
-                        le32_to_cpu(es->s_first_data_block),
-                        EXT4_BLOCKS_PER_GROUP(sb));
+        /*
+         * It makes no sense for the first data block to be beyond the end
+         * of the filesystem.
+         */
+        if (le32_to_cpu(es->s_first_data_block) >= ext4_blocks_count(es)) {
+                printk(KERN_WARNING "EXT4-fs: bad geometry: first data"
+                       "block %u is beyond end of filesystem (%llu)\n",
+                       le32_to_cpu(es->s_first_data_block),
+                       ext4_blocks_count(es));
                 goto failed_mount;
         }
         blocks_count = (ext4_blocks_count(es) -
                         le32_to_cpu(es->s_first_data_block) +
                         EXT4_BLOCKS_PER_GROUP(sb) - 1);
         do_div(blocks_count, EXT4_BLOCKS_PER_GROUP(sb));
+        if (blocks_count > ((uint64_t)1<<32) - EXT4_DESC_PER_BLOCK(sb)) {
+                printk(KERN_WARNING "EXT4-fs: groups count too large: %u "
+                       "(block count %llu, first data block %u, "
+                       "blocks per group %lu)\n", sbi->s_groups_count,
+                       ext4_blocks_count(es),
+                       le32_to_cpu(es->s_first_data_block),
+                       EXT4_BLOCKS_PER_GROUP(sb));
+                goto failed_mount;
+        }
         sbi->s_groups_count = blocks_count;
         db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
                    EXT4_DESC_PER_BLOCK(sb);