linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: akpm@osdl.org
To: torvalds@osdl.org
Cc: akpm@osdl.org, aia21@cantab.net, blaisorblade@yahoo.it,
	dhowells@redhat.com, dwmw2@infradead.org, green@linuxhacker.ru,
	hch@lst.de, jdike@addtoit.com, linux-fsdevel@vger.kernel.org,
	miklos@szeredi.hu, neilb@cse.unsw.edu.au,
	reiserfs-dev@namesys.com, rmk@arm.linux.org.uk,
	trond.myklebust@fys.uio.no, zippel@linux-m68k.org
Subject: [patch 146/233] fix possible PAGE_CACHE_SHIFT overflows
Date: Sun, 08 Jan 2006 01:03:05 -0800	[thread overview]
Message-ID: <200601080903.k0893GE9015082@shell0.pdx.osdl.net> (raw)


From: Andrew Morton <akpm@osdl.org>

We've had two instances recently of overflows when doing

	64_bit_value = (32_bit_value << PAGE_CACHE_SHIFT)

I did a tree-wide grep of `<<.*PAGE_CACHE_SHIFT' and this is the result.

- afs_rxfs_fetch_descriptor.offset is of type off_t, which seems broken.

- jfs and jffs are limited to 4GB anyway.

- reiserfs map_block_for_writepage() takes an unsigned long for the block -
  it should take sector_t.  (It'll fail for huge filesystems with
  blocksize<PAGE_CACHE_SIZE)

- cramfs_read() needs to use sector_t (I think cramsfs is busted on large
  filesystems anyway)

- affs is limited in file size anyway.

- I generally didn't fix 32-bit overflows in directory operations.

- arm's __flush_dcache_page() is peculiar.  What if the page lies beyond 4G?

- gss_wrap_req_priv() needs checking (snd_buf->page_base)


Cc: Oleg Drokin <green@linuxhacker.ru>
Cc: David Howells <dhowells@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: <reiserfs-dev@namesys.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Anton Altaparmakov <aia21@cantab.net>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Roman Zippel <zippel@linux-m68k.org>
Cc: <linux-fsdevel@vger.kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 fs/afs/dir.c             |    2 +-
 fs/buffer.c              |    6 +++---
 fs/freevxfs/vxfs_immed.c |    4 ++--
 fs/jffs/inode-v23.c      |    4 ++--
 fs/mpage.c               |    4 ++--
 fs/romfs/inode.c         |    6 +++---
 fs/smbfs/file.c          |    4 ++--
 fs/sysv/dir.c            |    4 ++--
 8 files changed, 17 insertions(+), 17 deletions(-)

diff -puN fs/afs/dir.c~fix-possible-page_cache_shift-overflows fs/afs/dir.c
--- devel/fs/afs/dir.c~fix-possible-page_cache_shift-overflows	2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/afs/dir.c	2006-01-08 00:56:54.000000000 -0800
@@ -137,7 +137,7 @@ static inline void afs_dir_check_page(st
 #endif
 
 	/* determine how many magic numbers there should be in this page */
-	latter = dir->i_size - (page->index << PAGE_CACHE_SHIFT);
+	latter = dir->i_size - page_offset(page);
 	if (latter >= PAGE_SIZE)
 		qty = PAGE_SIZE;
 	else
diff -puN fs/buffer.c~fix-possible-page_cache_shift-overflows fs/buffer.c
--- devel/fs/buffer.c~fix-possible-page_cache_shift-overflows	2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/buffer.c	2006-01-08 00:56:54.000000000 -0800
@@ -1762,7 +1762,7 @@ static int __block_write_full_page(struc
 	 * handle that here by just cleaning them.
 	 */
 
-	block = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+	block = (sector_t)page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
 	head = page_buffers(page);
 	bh = head;
 
@@ -2635,7 +2635,7 @@ int block_truncate_page(struct address_s
 	pgoff_t index = from >> PAGE_CACHE_SHIFT;
 	unsigned offset = from & (PAGE_CACHE_SIZE-1);
 	unsigned blocksize;
-	pgoff_t iblock;
+	sector_t iblock;
 	unsigned length, pos;
 	struct inode *inode = mapping->host;
 	struct page *page;
@@ -2651,7 +2651,7 @@ int block_truncate_page(struct address_s
 		return 0;
 
 	length = blocksize - length;
-	iblock = index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+	iblock = (sector_t)index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
 	
 	page = grab_cache_page(mapping, index);
 	err = -ENOMEM;
diff -puN fs/freevxfs/vxfs_immed.c~fix-possible-page_cache_shift-overflows fs/freevxfs/vxfs_immed.c
--- devel/fs/freevxfs/vxfs_immed.c~fix-possible-page_cache_shift-overflows	2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/freevxfs/vxfs_immed.c	2006-01-08 00:56:54.000000000 -0800
@@ -99,8 +99,8 @@ static int
 vxfs_immed_readpage(struct file *fp, struct page *pp)
 {
 	struct vxfs_inode_info	*vip = VXFS_INO(pp->mapping->host);
-	u_int64_t		offset = pp->index << PAGE_CACHE_SHIFT;
-	caddr_t			kaddr;
+	u_int64_t	offset = (u_int64_t)pp->index << PAGE_CACHE_SHIFT;
+	caddr_t		kaddr;
 
 	kaddr = kmap(pp);
 	memcpy(kaddr, vip->vii_immed.vi_immed + offset, PAGE_CACHE_SIZE);
diff -puN fs/jffs/inode-v23.c~fix-possible-page_cache_shift-overflows fs/jffs/inode-v23.c
--- devel/fs/jffs/inode-v23.c~fix-possible-page_cache_shift-overflows	2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/jffs/inode-v23.c	2006-01-08 00:56:54.000000000 -0800
@@ -757,7 +757,7 @@ jffs_do_readpage_nolock(struct file *fil
 
 	read_len = 0;
 	result = 0;
-	offset = page->index << PAGE_CACHE_SHIFT;
+	offset = page_offset(page);
 
 	kmap(page);
 	buf = page_address(page);
@@ -1545,7 +1545,7 @@ jffs_commit_write(struct file *filp, str
 {
        void *addr = page_address(page) + from;
        /* XXX: PAGE_CACHE_SHIFT or PAGE_SHIFT */
-       loff_t pos = (page->index<<PAGE_CACHE_SHIFT) + from;
+       loff_t pos = page_offset(page) + from;
 
        return jffs_file_write(filp, addr, to-from, &pos);
 } /* jffs_commit_write() */
diff -puN fs/mpage.c~fix-possible-page_cache_shift-overflows fs/mpage.c
--- devel/fs/mpage.c~fix-possible-page_cache_shift-overflows	2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/mpage.c	2006-01-08 00:56:54.000000000 -0800
@@ -184,7 +184,7 @@ do_mpage_readpage(struct bio *bio, struc
 	if (page_has_buffers(page))
 		goto confused;
 
-	block_in_file = page->index << (PAGE_CACHE_SHIFT - blkbits);
+	block_in_file = (sector_t)page->index << (PAGE_CACHE_SHIFT - blkbits);
 	last_block = (i_size_read(inode) + blocksize - 1) >> blkbits;
 
 	bh.b_page = page;
@@ -466,7 +466,7 @@ __mpage_writepage(struct bio *bio, struc
 	 * The page has no buffers: map it to disk
 	 */
 	BUG_ON(!PageUptodate(page));
-	block_in_file = page->index << (PAGE_CACHE_SHIFT - blkbits);
+	block_in_file = (sector_t)page->index << (PAGE_CACHE_SHIFT - blkbits);
 	last_block = (i_size - 1) >> blkbits;
 	map_bh.b_page = page;
 	for (page_block = 0; page_block < blocks_per_page; ) {
diff -puN fs/romfs/inode.c~fix-possible-page_cache_shift-overflows fs/romfs/inode.c
--- devel/fs/romfs/inode.c~fix-possible-page_cache_shift-overflows	2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/romfs/inode.c	2006-01-08 00:56:54.000000000 -0800
@@ -418,7 +418,7 @@ static int
 romfs_readpage(struct file *file, struct page * page)
 {
 	struct inode *inode = page->mapping->host;
-	unsigned long offset, avail, readlen;
+	loff_t offset, avail, readlen;
 	void *buf;
 	int result = -EIO;
 
@@ -429,8 +429,8 @@ romfs_readpage(struct file *file, struct
 		goto err_out;
 
 	/* 32 bit warning -- but not for us :) */
-	offset = page->index << PAGE_CACHE_SHIFT;
-	if (offset < inode->i_size) {
+	offset = page_offset(page);
+	if (offset < i_size_read(inode)) {
 		avail = inode->i_size-offset;
 		readlen = min_t(unsigned long, avail, PAGE_SIZE);
 		if (romfs_copyfrom(inode, buf, ROMFS_I(inode)->i_dataoffset+offset, readlen) == readlen) {
diff -puN fs/smbfs/file.c~fix-possible-page_cache_shift-overflows fs/smbfs/file.c
--- devel/fs/smbfs/file.c~fix-possible-page_cache_shift-overflows	2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/smbfs/file.c	2006-01-08 00:56:54.000000000 -0800
@@ -209,8 +209,8 @@ smb_updatepage(struct file *file, struct
 {
 	struct dentry *dentry = file->f_dentry;
 
-	DEBUG1("(%s/%s %d@%ld)\n", DENTRY_PATH(dentry), 
-	       count, (page->index << PAGE_CACHE_SHIFT)+offset);
+	DEBUG1("(%s/%s %d@%lld)\n", DENTRY_PATH(dentry), count,
+		((unsigned long long)page->index << PAGE_CACHE_SHIFT) + offset);
 
 	return smb_writepage_sync(dentry->d_inode, page, offset, count);
 }
diff -puN fs/sysv/dir.c~fix-possible-page_cache_shift-overflows fs/sysv/dir.c
--- devel/fs/sysv/dir.c~fix-possible-page_cache_shift-overflows	2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/sysv/dir.c	2006-01-08 00:56:54.000000000 -0800
@@ -103,7 +103,7 @@ static int sysv_readdir(struct file * fi
 			offset = (char *)de - kaddr;
 
 			over = filldir(dirent, name, strnlen(name,SYSV_NAMELEN),
-					(n<<PAGE_CACHE_SHIFT) | offset,
+					((loff_t)n<<PAGE_CACHE_SHIFT) | offset,
 					fs16_to_cpu(SYSV_SB(sb), de->inode),
 					DT_UNKNOWN);
 			if (over) {
@@ -115,7 +115,7 @@ static int sysv_readdir(struct file * fi
 	}
 
 done:
-	filp->f_pos = (n << PAGE_CACHE_SHIFT) | offset;
+	filp->f_pos = ((loff_t)n << PAGE_CACHE_SHIFT) | offset;
 	unlock_kernel();
 	return 0;
 }
_

             reply	other threads:[~2006-01-08  9:04 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2006-01-08  9:03 akpm [this message]
2006-01-08  9:13 ` [patch 146/233] fix possible PAGE_CACHE_SHIFT overflows Russell King
2006-01-08 19:37 ` Dave Kleikamp
2006-01-08 21:35   ` Andrew Morton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200601080903.k0893GE9015082@shell0.pdx.osdl.net \
    --to=akpm@osdl.org \
    --cc=aia21@cantab.net \
    --cc=blaisorblade@yahoo.it \
    --cc=dhowells@redhat.com \
    --cc=dwmw2@infradead.org \
    --cc=green@linuxhacker.ru \
    --cc=hch@lst.de \
    --cc=jdike@addtoit.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=miklos@szeredi.hu \
    --cc=neilb@cse.unsw.edu.au \
    --cc=reiserfs-dev@namesys.com \
    --cc=rmk@arm.linux.org.uk \
    --cc=torvalds@osdl.org \
    --cc=trond.myklebust@fys.uio.no \
    --cc=zippel@linux-m68k.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).