fs: Fix overflow in block_page_mkwrite
diff mbox series

Message ID 20191106190239.20860-1-agruenba@redhat.com
State New
Headers show
Series
  • fs: Fix overflow in block_page_mkwrite
Related show

Commit Message

Andreas Gruenbacher Nov. 6, 2019, 7:02 p.m. UTC 
On architectures where ssize_t is wider than pgoff_t, the expression
((page->index + 1) << PAGE_SHIFT) can overflow.  Rewrite to use the page
offset, which we already compute here anyway.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
---
 fs/buffer.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Comments

Christoph Hellwig Nov. 7, 2019, 8:43 a.m. UTC | #1 
On Wed, Nov 06, 2019 at 08:02:39PM +0100, Andreas Gruenbacher wrote:
> On architectures where ssize_t is wider than pgoff_t, the expression
> ((page->index + 1) << PAGE_SHIFT) can overflow.  Rewrite to use the page
> offset, which we already compute here anyway.

Looks good modulo the s/ssize_t/loff_t/ mentioned in the other patch:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Patch
diff mbox series 

diff --git a/fs/buffer.c b/fs/buffer.c
index 86a38b979323..da3f33b70249 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2459,21 +2459,21 @@  int block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
 	struct page *page = vmf->page;
 	struct inode *inode = file_inode(vma->vm_file);
 	unsigned long end;
-	loff_t size;
+	loff_t offset, size;
 	int ret;
 
 	lock_page(page);
 	size = i_size_read(inode);
-	if ((page->mapping != inode->i_mapping) ||
-	    (page_offset(page) > size)) {
+	offset = page_offset(page);
+	if (page->mapping != inode->i_mapping || offset > size) {
 		/* We overload EFAULT to mean page got truncated */
 		ret = -EFAULT;
 		goto out_unlock;
 	}
 
 	/* page is wholly or partially inside EOF */
-	if (((page->index + 1) << PAGE_SHIFT) > size)
-		end = size & ~PAGE_MASK;
+	if (offset > size - PAGE_SIZE)
+		end = offset_in_page(size);
 	else
 		end = PAGE_SIZE;