Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76b57302 authored by Peter Watkins's avatar Peter Watkins Committed by Dave Chinner
Browse files

xfs: overflow in xfs_iomap_eof_align_last_fsb 



If extsize is set and new_last_fsb is larger than 32 bits, the
roundup to extsize will overflow the align variable. Instead,
combine alignments by rounding stripe size up to extsize.

Signed-off-by: default avatarPeter Watkins <treestem@gmail.com>
Reviewed-by: default avatarNathaniel W. Turner <nate@houseofnate.net>
Reviewed-by: default avatarBrian Foster <bfoster@redhat.com>
Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
parent e77b8547

fs/xfs/xfs_iomap.c

+6 −7
Original line number Diff line number Diff line
@@ -52,7 +52,6 @@ xfs_iomap_eof_align_last_fsb( 
	xfs_extlen_t	extsize,

	xfs_fileoff_t	*last_fsb)

{

	xfs_fileoff_t	new_last_fsb = 0;

	xfs_extlen_t	align = 0;

	int		eof, error;
@@ -70,8 +69,8 @@ xfs_iomap_eof_align_last_fsb( 
		else if (mp->m_dalign)

			align = mp->m_dalign;



		if (align && XFS_ISIZE(ip) >= XFS_FSB_TO_B(mp, align))

			new_last_fsb = roundup_64(*last_fsb, align);

		if (align && XFS_ISIZE(ip) < XFS_FSB_TO_B(mp, align))

			align = 0;

	}



	/*
@@ -79,14 +78,14 @@ xfs_iomap_eof_align_last_fsb( 
	 * (when file on a real-time subvolume or has di_extsize hint).

	 */

	if (extsize) {

		if (new_last_fsb)

			align = roundup_64(new_last_fsb, extsize);

		if (align)

			align = roundup_64(align, extsize);

		else

			align = extsize;

		new_last_fsb = roundup_64(*last_fsb, align);

	}



	if (new_last_fsb) {

	if (align) {

		xfs_fileoff_t	new_last_fsb = roundup_64(*last_fsb, align);

		error = xfs_bmap_eof(ip, new_last_fsb, XFS_DATA_FORK, &eof);

		if (error)

			return error;