Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18336338 authored by Nick Piggin's avatar Nick Piggin Committed by Linus Torvalds
Browse files

fix some conversion overflows 



Fix page index to offset conversion overflows in buffer layer, ecryptfs,
and ocfs2.

It would be nice to convert the whole tree to page_offset, but for now
just fix the bugs.

Signed-off-by: default avatarNick Piggin <npiggin@suse.de>
Cc: Michael Halcrow <mhalcrow@us.ibm.com>
Cc: Mark Fasheh <mark.fasheh@oracle.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent e228929b

fs/buffer.c

+1 −1
Original line number Diff line number Diff line
@@ -2221,7 +2221,7 @@ block_page_mkwrite(struct vm_area_struct *vma, struct page *page, 
	lock_page(page);

	size = i_size_read(inode);

	if ((page->mapping != inode->i_mapping) ||

	    ((page->index << PAGE_CACHE_SHIFT) > size)) {

	    (page_offset(page) > size)) {

		/* page got truncated out from underneath us */

		goto out_unlock;

	}

fs/ecryptfs/mmap.c

+2 −3
Original line number Diff line number Diff line
@@ -409,8 +409,7 @@ static int ecryptfs_prepare_write(struct file *file, struct page *page, 
	if (!PageUptodate(page))

		rc = ecryptfs_do_readpage(file, page, page->index);

	if (page->index != 0) {

		loff_t end_of_prev_pg_pos =

			(((loff_t)page->index << PAGE_CACHE_SHIFT) - 1);

		loff_t end_of_prev_pg_pos = page_offset(page) - 1;



		if (end_of_prev_pg_pos > i_size_read(page->mapping->host)) {

			rc = ecryptfs_truncate(file->f_path.dentry,
@@ -736,7 +735,7 @@ static int ecryptfs_commit_write(struct file *file, struct page *page, 
		goto out;

	}

	inode->i_blocks = lower_inode->i_blocks;

	pos = (page->index << PAGE_CACHE_SHIFT) + to;

	pos = page_offset(page) + to;

	if (pos > i_size_read(inode)) {

		i_size_write(inode, pos);

		ecryptfs_printk(KERN_DEBUG, "Expanded file size to "

fs/ocfs2/mmap.c

+1 −1
Original line number Diff line number Diff line
@@ -89,7 +89,7 @@ static int __ocfs2_page_mkwrite(struct inode *inode, struct buffer_head *di_bh, 
{

	int ret;

	struct address_space *mapping = inode->i_mapping;

	loff_t pos = page->index << PAGE_CACHE_SHIFT;

	loff_t pos = page_offset(page);

	unsigned int len = PAGE_CACHE_SIZE;

	pgoff_t last_index;

	struct page *locked_page = NULL;