From: ben.hutchings@codethink.co.uk (Ben Hutchings)
To: cip-dev@lists.cip-project.org
Subject: [cip-dev] [PATCH 4.4-cip 11/23] btrfs: fix int32 overflow in shrink_delalloc().
Date: Fri, 09 Dec 2016 00:35:58 +0000 [thread overview]
Message-ID: <1481243758.1860.167.camel@codethink.co.uk> (raw)
In-Reply-To: <1481243545.1860.156.camel@codethink.co.uk>
From: Adam Borowski <kilobyte@angband.pl>
commit 8eb0dfdbda3f56bf7d248ed87fcc383df114ecbb upstream.
UBSAN: Undefined behaviour in fs/btrfs/extent-tree.c:4623:21
signed integer overflow:
10808 * 262144 cannot be represented in type 'int [8]'
If 8192<=items<16384, we request a writeback of an insane number of pages
which is benign (everything will be written). But if items>=16384, the
space reservation won't be enough.
Signed-off-by: Adam Borowski <kilobyte@angband.pl>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
---
fs/btrfs/extent-tree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 47cdc6f3390b..a4d7dbe2619e 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4568,7 +4568,7 @@ static void shrink_delalloc(struct btrfs_root *root, u64 to_reclaim, u64 orig,
/* Calc the number of the pages we need flush for space reservation */
items = calc_reclaim_items_nr(root, to_reclaim);
- to_reclaim = items * EXTENT_SIZE_PER_ITEM;
+ to_reclaim = (u64)items * EXTENT_SIZE_PER_ITEM;
trans = (struct btrfs_trans_handle *)current->journal_info;
block_rsv = &root->fs_info->delalloc_block_rsv;
--
2.10.2
--
Ben Hutchings
Software Developer, Codethink Ltd.
next prev parent reply other threads:[~2016-12-09 0:35 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-09 0:32 [cip-dev] [PATCH 4.4-cip 00/23] Undefined Behaviour Sanititizer support Ben Hutchings
2016-12-09 0:33 ` [cip-dev] [PATCH 4.4-cip 01/23] UBSAN: run-time undefined behavior sanity checker Ben Hutchings
2016-12-09 0:33 ` [cip-dev] [PATCH 4.4-cip 02/23] ubsan: cosmetic fix to Kconfig text Ben Hutchings
2016-12-09 0:34 ` [cip-dev] [PATCH 4.4-cip 03/23] PM / sleep: declare __tracedata symbols as char[] rather than char Ben Hutchings
2016-12-09 0:34 ` [cip-dev] [PATCH 4.4-cip 04/23] x86/microcode/intel: Change checksum variables to u32 Ben Hutchings
2016-12-09 0:34 ` [cip-dev] [PATCH 4.4-cip 05/23] mm/page-writeback: fix dirty_ratelimit calculation Ben Hutchings
2016-12-09 0:34 ` [cip-dev] [PATCH 4.4-cip 06/23] perf/core: Fix Undefined behaviour in rb_alloc() Ben Hutchings
2016-12-09 0:35 ` [cip-dev] [PATCH 4.4-cip 07/23] ubsan: fix tree-wide -Wmaybe-uninitialized false positives Ben Hutchings
2016-12-09 0:35 ` [cip-dev] [PATCH 4.4-cip 08/23] mm/filemap: generic_file_read_iter(): check for zero reads unconditionally Ben Hutchings
2016-12-09 0:35 ` [cip-dev] [PATCH 4.4-cip 09/23] perf/x86/amd: Set the size of event map array to PERF_COUNT_HW_MAX Ben Hutchings
2016-12-09 0:35 ` [cip-dev] [PATCH 4.4-cip 10/23] drm/radeon: don't include RADEON_HPD_NONE in HPD IRQ enable bitsets Ben Hutchings
2016-12-09 0:35 ` Ben Hutchings [this message]
2016-12-09 0:36 ` [cip-dev] [PATCH 4.4-cip 12/23] blk-mq: fix undefined behaviour in order_to_size() Ben Hutchings
2016-12-09 0:36 ` [cip-dev] [PATCH 4.4-cip 13/23] batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq Ben Hutchings
2016-12-09 0:36 ` [cip-dev] [PATCH 4.4-cip 14/23] signal: move the "sig < SIGRTMIN" check into siginmask(sig) Ben Hutchings
2016-12-09 0:36 ` [cip-dev] [PATCH 4.4-cip 15/23] mmc: dw_mmc: remove UBSAN warning in dw_mci_setup_bus() Ben Hutchings
2016-12-09 0:36 ` [cip-dev] [PATCH 4.4-cip 16/23] UBSAN: fix typo in format string Ben Hutchings
2016-12-09 0:37 ` [cip-dev] [PATCH 4.4-cip 17/23] rhashtable: fix shift by 64 when shrinking Ben Hutchings
2016-12-09 0:37 ` [cip-dev] [PATCH 4.4-cip 18/23] time: Avoid undefined behaviour in ktime_add_safe() Ben Hutchings
2016-12-09 0:39 ` [cip-dev] [PATCH 4.4-cip 19/23] pwm: samsung: Fix to use lowest div for large enough modulation bits Ben Hutchings
2016-12-09 0:39 ` [cip-dev] [PATCH 4.4-cip 20/23] drm: fix signed integer overflow Ben Hutchings
2016-12-09 0:39 ` [cip-dev] [PATCH 4.4-cip 21/23] xfs: " Ben Hutchings
2016-12-09 0:41 ` [cip-dev] [PATCH 4.4-cip 22/23] net: get rid of an signed integer overflow in ip_idents_reserve() Ben Hutchings
2016-12-09 0:41 ` [cip-dev] [PATCH 4.4-cip 23/23] mlx4: remove unused fields Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1481243758.1860.167.camel@codethink.co.uk \
--to=ben.hutchings@codethink.co.uk \
--cc=cip-dev@lists.cip-project.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox