Skip to content

Commit

Permalink
ocfs2: Fix memory overflow in cow_by_page.
Browse files Browse the repository at this point in the history
In ocfs2_duplicate_clusters_by_page, we calculate map_end
by shifting page_index. But actually in case we meet with
a large offset(say in a i686 box, poff_t is only 32 bits
and page_index=2056240), we will overflow. So change the
type of page_index to loff_t.

Signed-off-by: Tao Ma <tao.ma@oracle.com>
Signed-off-by: Joel Becker <joel.becker@oracle.com>
  • Loading branch information
Tao Ma authored and Joel Becker committed Feb 3, 2010
1 parent 26636bf commit d622b89
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions fs/ocfs2/refcounttree.c
Original file line number Diff line number Diff line change
Expand Up @@ -2945,7 +2945,7 @@ static int ocfs2_duplicate_clusters_by_page(handle_t *handle,

while (offset < end) {
page_index = offset >> PAGE_CACHE_SHIFT;
map_end = (page_index + 1) << PAGE_CACHE_SHIFT;
map_end = ((loff_t)page_index + 1) << PAGE_CACHE_SHIFT;
if (map_end > end)
map_end = end;

Expand Down Expand Up @@ -3170,7 +3170,7 @@ static int ocfs2_cow_sync_writeback(struct super_block *sb,

while (offset < end) {
page_index = offset >> PAGE_CACHE_SHIFT;
map_end = (page_index + 1) << PAGE_CACHE_SHIFT;
map_end = ((loff_t)page_index + 1) << PAGE_CACHE_SHIFT;
if (map_end > end)
map_end = end;

Expand Down

0 comments on commit d622b89

Please sign in to comment.