[PATCH] f2fs: fix a dead loop in f2fs_fiemap()

[PATCH] f2fs: fix a dead loop in f2fs_fiemap()

[Wei Fang]

A dead loop can be triggered in f2fs_fiemap() using the test case
as below:

	...
	fd = open();
	fallocate(fd, 0, 0, 4294967296);
	ioctl(fd, FS_IOC_FIEMAP, fiemap_buf);
	...

It's caused by an overflow in __get_data_block():
	...
	bh->b_size = map.m_len << inode->i_blkbits;
	...
map.m_len is an unsigned int, and bh->b_size is a size_t which is 64 bits
on 64 bits archtecture, type conversion from an unsigned int to a size_t
will result in an overflow.

In the above-mentioned case, bh->b_size will be zero, and f2fs_fiemap()
will call get_data_block() at block 0 again an again.

Fix this by adding a force conversion before left shift.

Signed-off-by: Wei Fang <fangwei1@huawei.com>
---
 fs/f2fs/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 848d110..06cf0c5 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -961,7 +961,7 @@ static int __get_data_block(struct inode *inode, sector_t iblock,
 	if (!err) {
 		map_bh(bh, inode->i_sb, map.m_pblk);
 		bh->b_state = (bh->b_state & ~F2FS_MAP_FLAGS) | map.m_flags;
-		bh->b_size = map.m_len << inode->i_blkbits;
+		bh->b_size = (u64)map.m_len << inode->i_blkbits;
 	}
 	return err;
 }
-- 
2.4.11


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

Re: [PATCH] f2fs: fix a dead loop in f2fs_fiemap()

[Chao Yu]

On 2017/1/22 12:21, Wei Fang wrote:
> A dead loop can be triggered in f2fs_fiemap() using the test case
> as below:
> 
> 	...
> 	fd = open();
> 	fallocate(fd, 0, 0, 4294967296);
> 	ioctl(fd, FS_IOC_FIEMAP, fiemap_buf);
> 	...
> 
> It's caused by an overflow in __get_data_block():
> 	...
> 	bh->b_size = map.m_len << inode->i_blkbits;
> 	...
> map.m_len is an unsigned int, and bh->b_size is a size_t which is 64 bits
> on 64 bits archtecture, type conversion from an unsigned int to a size_t
> will result in an overflow.
> 
> In the above-mentioned case, bh->b_size will be zero, and f2fs_fiemap()
> will call get_data_block() at block 0 again an again.
> 
> Fix this by adding a force conversion before left shift.

Nice catch!

> 
> Signed-off-by: Wei Fang <fangwei1@huawei.com>

Acked-by: Chao Yu <yuchao0@huawei.com>

Thanks,


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot