Unverified Commit dfdb6e44 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8947 [sync] PR-6800: block: fix overflow in blk_ioctl_discard() 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/6800 
 
PR sync from: Li Nan <linan122@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/QWJOCDRXF23DWNIR4OTXUHH6VJ4E4N7F/ 
 
https://gitee.com/openeuler/kernel/issues/I9K0H3 
 
Link:https://gitee.com/openeuler/kernel/pulls/8947

 

Reviewed-by: default avatarYu Kuai <yukuai3@huawei.com>
Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 704d85a2 2973f3f6

block/ioctl.c

+3 −2
Original line number Diff line number Diff line
@@ -101,7 +101,7 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode, 
		unsigned long arg, unsigned long flags)

{

	uint64_t range[2];

	uint64_t start, len;

	uint64_t start, len, end;

	struct request_queue *q = bdev_get_queue(bdev);

	int err;
@@ -122,7 +122,8 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode, 
	if (len & 511)

		return -EINVAL;



	if (start + len > i_size_read(bdev->bd_inode))

	if (check_add_overflow(start, len, &end) ||

	    end > i_size_read(bdev->bd_inode))

		return -EINVAL;



	err = truncate_bdev_range(bdev, mode, start, start + len - 1);