lkml.org 
[lkml]   [2020]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 033/330] iomap: Fix overflow in iomap_page_mkwrite
    Date
    From: Andreas Gruenbacher <agruenba@redhat.com>

    [ Upstream commit add66fcbd3fbe5aa0dd4dddfa23e119c12989a27 ]

    On architectures where loff_t is wider than pgoff_t, the expression
    ((page->index + 1) << PAGE_SHIFT) can overflow. Rewrite to use the page
    offset, which we already compute here anyway.

    Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
    Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/iomap/buffered-io.c | 7 +++----
    1 file changed, 3 insertions(+), 4 deletions(-)

    diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
    index e25901ae3ff44..a30ea7ecb790a 100644
    --- a/fs/iomap/buffered-io.c
    +++ b/fs/iomap/buffered-io.c
    @@ -1040,20 +1040,19 @@ vm_fault_t iomap_page_mkwrite(struct vm_fault *vmf, const struct iomap_ops *ops)

    lock_page(page);
    size = i_size_read(inode);
    - if ((page->mapping != inode->i_mapping) ||
    - (page_offset(page) > size)) {
    + offset = page_offset(page);
    + if (page->mapping != inode->i_mapping || offset > size) {
    /* We overload EFAULT to mean page got truncated */
    ret = -EFAULT;
    goto out_unlock;
    }

    /* page is wholly or partially inside EOF */
    - if (((page->index + 1) << PAGE_SHIFT) > size)
    + if (offset > size - PAGE_SIZE)
    length = offset_in_page(size);
    else
    length = PAGE_SIZE;

    - offset = page_offset(page);
    while (length > 0) {
    ret = iomap_apply(inode, offset, length,
    IOMAP_WRITE | IOMAP_FAULT, ops, page,
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-09-18 05:14    [W:4.033 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site