Skip to contentSkip to conversation

xfs: fix s_maxbytes overflow problems

PATCH In review Darrick J. Wong 2 participants 2 messages Dec 22, 2017 – Dec 29, 2017 XFS filesystem

lore
Share & tools
lore

Darrick J. Wong

author
#0 lore raw

PATCH 1/1 xfs: fix s_maxbytes overflow problems

From: Darrick J. Wong <[email protected]>

Fix some integer overflow problems if offset + count happen to be large enough to cause an integer overflow.

Signed-off-by Darrick J. Wong <[email protected]>
---
 fs/xfs/xfs_aops.c  |    4 ++--
 fs/xfs/xfs_iomap.c |    2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
fs/xfs/xfs_aops.c +2 -2
index 21e2d70..4fc526a 100644
@@ -399,7 +399,7 @@ xfs_map_blocks(
 	       (ip->i_df.if_flags & XFS_IFEXTENTS));
 	ASSERT(offset <= mp->m_super->s_maxbytes);
 
-	if ((xfs_ufsize_t)offset + count > mp->m_super->s_maxbytes)
+	if (offset > mp->m_super->s_maxbytes - count)
 		count = mp->m_super->s_maxbytes - offset;
 	end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + count);
 	offset_fsb = XFS_B_TO_FSBT(mp, offset);

@@ -1312,7 +1312,7 @@ xfs_get_blocks(
 	lockmode = xfs_ilock_data_map_shared(ip);
 
 	ASSERT(offset <= mp->m_super->s_maxbytes);
-	if ((xfs_ufsize_t)offset + size > mp->m_super->s_maxbytes)
+	if (offset > mp->m_super->s_maxbytes - size)
 		size = mp->m_super->s_maxbytes - offset;
 	end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + size);
 	offset_fsb = XFS_B_TO_FSBT(mp, offset);
fs/xfs/xfs_iomap.c +1 -1
index 7ab52a8..66e1edb 100644
@@ -1006,7 +1006,7 @@ xfs_file_iomap_begin(
 	}
 
 	ASSERT(offset <= mp->m_super->s_maxbytes);
-	if ((xfs_fsize_t)offset + length > mp->m_super->s_maxbytes)
+	if (offset > mp->m_super->s_maxbytes - length)
 		length = mp->m_super->s_maxbytes - offset;
 	offset_fsb = XFS_B_TO_FSBT(mp, offset);
 	end_fsb = XFS_B_TO_FSB(mp, offset + length);