Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9ad9c16e authored by Andrew Price's avatar Andrew Price Committed by Greg Kroah-Hartman
Browse files

gfs2: Fix invalid metadata access in punch_hole 



[ Upstream commit c95346ac918c5badf51b9a7ac58a26d3bd5bb224 ]

In punch_hole(), when the offset lies in the final block for a given
height, there is no hole to punch, but the maximum size check fails to
detect that.  Consequently, punch_hole() will try to punch a hole beyond
the end of the metadata and fail.  Fix the maximum size check.

Signed-off-by: default avatarAndrew Price <anprice@redhat.com>
Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent b241595d

fs/gfs2/bmap.c

+3 −2
Original line number Diff line number Diff line
@@ -1751,7 +1751,8 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length) 
	struct buffer_head *dibh, *bh;

	struct gfs2_holder rd_gh;

	unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift;

	u64 lblock = (offset + (1 << bsize_shift) - 1) >> bsize_shift;

	unsigned int bsize = 1 << bsize_shift;

	u64 lblock = (offset + bsize - 1) >> bsize_shift;

	__u16 start_list[GFS2_MAX_META_HEIGHT];

	__u16 __end_list[GFS2_MAX_META_HEIGHT], *end_list = NULL;

	unsigned int start_aligned, end_aligned;
@@ -1762,7 +1763,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length) 
	u64 prev_bnr = 0;

	__be64 *start, *end;



	if (offset >= maxsize) {

	if (offset + bsize - 1 >= maxsize) {

		/*

		 * The starting point lies beyond the allocated meta-data;

		 * there are no blocks do deallocate.