Commit ae507f78 authored Sep 16, 2019 by Sahitya Tummala

f2fs: add a condition to detect overflow in f2fs_ioc_gc_range()



end = range.start + range.len;

If the range.start/range.len is a very large value, then end can overflow
in this operation. It results into a crash in get_valid_blocks() when
accessing the invalid range.start segno.

Change-Id: I865d05098890c16ae8d5380038ef71c20d0f9a4a
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>

parent 7adfd57c

fs/f2fs/file.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -2178,9 +2178,9 @@ static int f2fs_ioc_gc_range(struct file *filp, unsigned long arg)
		return -EROFS;

		end = range.start + range.len;
		if (range.start < MAIN_BLKADDR(sbi) \|\| end >= MAX_BLKADDR(sbi)) {
		if (end < range.start \|\| range.start < MAIN_BLKADDR(sbi) \|\|
		end >= MAX_BLKADDR(sbi))
		return -EINVAL;
		}

		ret = mnt_want_write_file(filp);
		if (ret)