Skip to content

Commit

Permalink
vfs: explicitly cast s_maxbytes in fiemap_check_ranges
Browse files Browse the repository at this point in the history
If fiemap_check_ranges is passed a large enough value, then it's
possible that the value would be cast to a signed value for comparison
against s_maxbytes when we change it to loff_t. Make sure that doesn't
happen by explicitly casting s_maxbytes to an unsigned value for the
purposes of comparison.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Robert Love <rlove@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mandeep Singh Baines <msb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  • Loading branch information
Jeff Layton authored and Al Viro committed Sep 24, 2009
1 parent 05cc0ce commit 5aa98b7
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions fs/ioctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -162,20 +162,21 @@ EXPORT_SYMBOL(fiemap_check_flags);
static int fiemap_check_ranges(struct super_block *sb,
u64 start, u64 len, u64 *new_len)
{
u64 maxbytes = (u64) sb->s_maxbytes;

*new_len = len;

if (len == 0)
return -EINVAL;

if (start > sb->s_maxbytes)
if (start > maxbytes)
return -EFBIG;

/*
* Shrink request scope to what the fs can actually handle.
*/
if ((len > sb->s_maxbytes) ||
(sb->s_maxbytes - len) < start)
*new_len = sb->s_maxbytes - start;
if (len > maxbytes || (maxbytes - len) < start)
*new_len = maxbytes - start;

return 0;
}
Expand Down

0 comments on commit 5aa98b7

Please sign in to comment.