Commit b4d8ad7f authored by Darrick J. Wong's avatar Darrick J. Wong
Browse files

xfs: fix s_maxbytes overflow problems 



Fix some integer overflow problems if offset + count happen to be large
enough to cause an integer overflow.

Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
parent 3a3882ff

fs/xfs/xfs_aops.c

+2 −2
Original line number Diff line number Diff line
@@ -399,7 +399,7 @@ xfs_map_blocks( 
	       (ip->i_df.if_flags & XFS_IFEXTENTS));

	ASSERT(offset <= mp->m_super->s_maxbytes);



	if ((xfs_ufsize_t)offset + count > mp->m_super->s_maxbytes)

	if (offset > mp->m_super->s_maxbytes - count)

		count = mp->m_super->s_maxbytes - offset;

	end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + count);

	offset_fsb = XFS_B_TO_FSBT(mp, offset);
@@ -1312,7 +1312,7 @@ xfs_get_blocks( 
	lockmode = xfs_ilock_data_map_shared(ip);



	ASSERT(offset <= mp->m_super->s_maxbytes);

	if ((xfs_ufsize_t)offset + size > mp->m_super->s_maxbytes)

	if (offset > mp->m_super->s_maxbytes - size)

		size = mp->m_super->s_maxbytes - offset;

	end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + size);

	offset_fsb = XFS_B_TO_FSBT(mp, offset);

fs/xfs/xfs_iomap.c

+1 −1
Original line number Diff line number Diff line
@@ -1006,7 +1006,7 @@ xfs_file_iomap_begin( 
	}



	ASSERT(offset <= mp->m_super->s_maxbytes);

	if ((xfs_fsize_t)offset + length > mp->m_super->s_maxbytes)

	if (offset > mp->m_super->s_maxbytes - length)

		length = mp->m_super->s_maxbytes - offset;

	offset_fsb = XFS_B_TO_FSBT(mp, offset);

	end_fsb = XFS_B_TO_FSB(mp, offset + length);