* [PATCH] fs: Fix overflow in block_page_mkwrite
@ 2019-11-06 19:02 Andreas Gruenbacher
2019-11-07 8:43 ` Christoph Hellwig
2019-12-18 12:43 ` Jan Kara
0 siblings, 2 replies; 4+ messages in thread
From: Andreas Gruenbacher @ 2019-11-06 19:02 UTC (permalink / raw)
To: Alexander Viro, linux-fsdevel; +Cc: Christoph Hellwig, Andreas Gruenbacher
On architectures where ssize_t is wider than pgoff_t, the expression
((page->index + 1) << PAGE_SHIFT) can overflow. Rewrite to use the page
offset, which we already compute here anyway.
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
---
fs/buffer.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/buffer.c b/fs/buffer.c
index 86a38b979323..da3f33b70249 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2459,21 +2459,21 @@ int block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
struct page *page = vmf->page;
struct inode *inode = file_inode(vma->vm_file);
unsigned long end;
- loff_t size;
+ loff_t offset, size;
int ret;
lock_page(page);
size = i_size_read(inode);
- if ((page->mapping != inode->i_mapping) ||
- (page_offset(page) > size)) {
+ offset = page_offset(page);
+ if (page->mapping != inode->i_mapping || offset > size) {
/* We overload EFAULT to mean page got truncated */
ret = -EFAULT;
goto out_unlock;
}
/* page is wholly or partially inside EOF */
- if (((page->index + 1) << PAGE_SHIFT) > size)
- end = size & ~PAGE_MASK;
+ if (offset > size - PAGE_SIZE)
+ end = offset_in_page(size);
else
end = PAGE_SIZE;
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] fs: Fix overflow in block_page_mkwrite
2019-11-06 19:02 [PATCH] fs: Fix overflow in block_page_mkwrite Andreas Gruenbacher
@ 2019-11-07 8:43 ` Christoph Hellwig
2019-12-18 12:43 ` Jan Kara
1 sibling, 0 replies; 4+ messages in thread
From: Christoph Hellwig @ 2019-11-07 8:43 UTC (permalink / raw)
To: Andreas Gruenbacher; +Cc: Alexander Viro, linux-fsdevel, Christoph Hellwig
On Wed, Nov 06, 2019 at 08:02:39PM +0100, Andreas Gruenbacher wrote:
> On architectures where ssize_t is wider than pgoff_t, the expression
> ((page->index + 1) << PAGE_SHIFT) can overflow. Rewrite to use the page
> offset, which we already compute here anyway.
Looks good modulo the s/ssize_t/loff_t/ mentioned in the other patch:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] fs: Fix overflow in block_page_mkwrite
2019-11-06 19:02 [PATCH] fs: Fix overflow in block_page_mkwrite Andreas Gruenbacher
2019-11-07 8:43 ` Christoph Hellwig
@ 2019-12-18 12:43 ` Jan Kara
2019-12-18 12:51 ` Andreas Gruenbacher
1 sibling, 1 reply; 4+ messages in thread
From: Jan Kara @ 2019-12-18 12:43 UTC (permalink / raw)
To: Andreas Gruenbacher; +Cc: Alexander Viro, linux-fsdevel, Christoph Hellwig
On Wed 06-11-19 20:02:39, Andreas Gruenbacher wrote:
> On architectures where ssize_t is wider than pgoff_t, the expression
> ((page->index + 1) << PAGE_SHIFT) can overflow. Rewrite to use the page
> offset, which we already compute here anyway.
>
> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
This patch seems to have fallen through the cracks? Al?
Honza
> ---
> fs/buffer.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 86a38b979323..da3f33b70249 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -2459,21 +2459,21 @@ int block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
> struct page *page = vmf->page;
> struct inode *inode = file_inode(vma->vm_file);
> unsigned long end;
> - loff_t size;
> + loff_t offset, size;
> int ret;
>
> lock_page(page);
> size = i_size_read(inode);
> - if ((page->mapping != inode->i_mapping) ||
> - (page_offset(page) > size)) {
> + offset = page_offset(page);
> + if (page->mapping != inode->i_mapping || offset > size) {
> /* We overload EFAULT to mean page got truncated */
> ret = -EFAULT;
> goto out_unlock;
> }
>
> /* page is wholly or partially inside EOF */
> - if (((page->index + 1) << PAGE_SHIFT) > size)
> - end = size & ~PAGE_MASK;
> + if (offset > size - PAGE_SIZE)
> + end = offset_in_page(size);
> else
> end = PAGE_SIZE;
>
> --
> 2.20.1
>
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] fs: Fix overflow in block_page_mkwrite
2019-12-18 12:43 ` Jan Kara
@ 2019-12-18 12:51 ` Andreas Gruenbacher
0 siblings, 0 replies; 4+ messages in thread
From: Andreas Gruenbacher @ 2019-12-18 12:51 UTC (permalink / raw)
To: Jan Kara; +Cc: Alexander Viro, linux-fsdevel, Christoph Hellwig
Hi Jan,
On Wed, Dec 18, 2019 at 1:43 PM Jan Kara <jack@suse.cz> wrote:
> On Wed 06-11-19 20:02:39, Andreas Gruenbacher wrote:
> > On architectures where ssize_t is wider than pgoff_t, the expression
> > ((page->index + 1) << PAGE_SHIFT) can overflow. Rewrite to use the page
> > offset, which we already compute here anyway.
> >
> > Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
>
> This patch seems to have fallen through the cracks? Al?
There's been a v2 of this patch [*] and I'm about to send out a v3, so
please ignore this first version.
Thanks,
Andreas
[*] https://lore.kernel.org/linux-fsdevel/20191129142045.7215-1-agruenba@redhat.com/
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-12-18 12:52 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-06 19:02 [PATCH] fs: Fix overflow in block_page_mkwrite Andreas Gruenbacher
2019-11-07 8:43 ` Christoph Hellwig
2019-12-18 12:43 ` Jan Kara
2019-12-18 12:51 ` Andreas Gruenbacher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).