diff mbox series

xfs: fix integer overflow in xrep_bmap

Message ID 20241008040708.GQ21853@frogsfrogsfrogs (mailing list archive)
State Queued
Headers show
Series xfs: fix integer overflow in xrep_bmap | expand

Commit Message

Darrick J. Wong Oct. 8, 2024, 4:07 a.m. UTC 
From: Darrick J. Wong <djwong@kernel.org>

The variable declaration in this function predates the merge of the
nrext64 (aka 64-bit extent counters) feature, which means that the
variable declaration type is insufficient to avoid an integer overflow.
Fix that by redeclaring the variable to be xfs_extnum_t.

Coverity-id: 1630958
Fixes: 8f71bede8efd ("xfs: repair inode fork block mapping data structures")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
---
 fs/xfs/scrub/bmap_repair.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Christoph Hellwig Oct. 8, 2024, 4:33 a.m. UTC | #1 
On Mon, Oct 07, 2024 at 09:07:08PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
> 
> The variable declaration in this function predates the merge of the
> nrext64 (aka 64-bit extent counters) feature, which means that the
> variable declaration type is insufficient to avoid an integer overflow.
> Fix that by redeclaring the variable to be xfs_extnum_t.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>
Carlos Maiolino Oct. 15, 2024, 11:09 a.m. UTC | #2 
On Mon, 07 Oct 2024 21:07:08 -0700, Darrick J. Wong wrote:
> The variable declaration in this function predates the merge of the
> nrext64 (aka 64-bit extent counters) feature, which means that the
> variable declaration type is insufficient to avoid an integer overflow.
> Fix that by redeclaring the variable to be xfs_extnum_t.
> 
> 

Applied to for-next, thanks!

[1/1] xfs: fix integer overflow in xrep_bmap
      commit: 0fb823f1cf3417e06846d1ffe2c97e10a65a847e

Best regards,
diff mbox series

Patch

diff --git a/fs/xfs/scrub/bmap_repair.c b/fs/xfs/scrub/bmap_repair.c
index 49dc38acc66bf..4505f4829d53f 100644
--- a/fs/xfs/scrub/bmap_repair.c
+++ b/fs/xfs/scrub/bmap_repair.c
@@ -801,7 +801,7 @@  xrep_bmap(
 {
 	struct xrep_bmap	*rb;
 	char			*descr;
-	unsigned int		max_bmbt_recs;
+	xfs_extnum_t		max_bmbt_recs;
 	bool			large_extcount;
 	int			error = 0;