Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5aa98b70 authored by Jeff Layton's avatar Jeff Layton Committed by Al Viro
Browse files

vfs: explicitly cast s_maxbytes in fiemap_check_ranges 



If fiemap_check_ranges is passed a large enough value, then it's
possible that the value would be cast to a signed value for comparison
against s_maxbytes when we change it to loff_t. Make sure that doesn't
happen by explicitly casting s_maxbytes to an unsigned value for the
purposes of comparison.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Robert Love <rlove@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mandeep Singh Baines <msb@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 05cc0cee

fs/ioctl.c

+5 −4
Original line number Original line Diff line number Diff line
@@ -162,20 +162,21 @@ EXPORT_SYMBOL(fiemap_check_flags); 
static int fiemap_check_ranges(struct super_block *sb,

static int fiemap_check_ranges(struct super_block *sb,

			       u64 start, u64 len, u64 *new_len)

			       u64 start, u64 len, u64 *new_len)

{

{

	u64 maxbytes = (u64) sb->s_maxbytes;



	*new_len = len;

	*new_len = len;





	if (len == 0)

	if (len == 0)

		return -EINVAL;

		return -EINVAL;





	if (start > sb->s_maxbytes)

	if (start > maxbytes)

		return -EFBIG;

		return -EFBIG;





	/*

	/*

	 * Shrink request scope to what the fs can actually handle.

	 * Shrink request scope to what the fs can actually handle.

	 */

	 */

	if ((len > sb->s_maxbytes) ||

	if (len > maxbytes || (maxbytes - len) < start)

	    (sb->s_maxbytes - len) < start)

		*new_len = maxbytes - start;

		*new_len = sb->s_maxbytes - start;





	return 0;

	return 0;

}

}