* - fix-possible-page_cache_shift-overflows.patch removed from -mm tree
@ 2006-01-09 6:29 akpm
0 siblings, 0 replies; only message in thread
From: akpm @ 2006-01-09 6:29 UTC (permalink / raw)
To: akpm, aia21, blaisorblade, dhowells, dwmw2, green, hch, jdike,
linux-fsdevel, miklos, neilb, reiserfs-dev, rmk, trond.myklebust,
zippel, mm-commits
The patch titled
fix possible PAGE_CACHE_SHIFT overflows
has been removed from the -mm tree. Its filename is
fix-possible-page_cache_shift-overflows.patch
This patch was probably dropped from -mm because
it has already been merged into a subsystem tree
or into Linus's tree
From: Andrew Morton <akpm@osdl.org>
We've had two instances recently of overflows when doing
64_bit_value = (32_bit_value << PAGE_CACHE_SHIFT)
I did a tree-wide grep of `<<.*PAGE_CACHE_SHIFT' and this is the result.
- afs_rxfs_fetch_descriptor.offset is of type off_t, which seems broken.
- jfs and jffs are limited to 4GB anyway.
- reiserfs map_block_for_writepage() takes an unsigned long for the block -
it should take sector_t. (It'll fail for huge filesystems with
blocksize<PAGE_CACHE_SIZE)
- cramfs_read() needs to use sector_t (I think cramsfs is busted on large
filesystems anyway)
- affs is limited in file size anyway.
- I generally didn't fix 32-bit overflows in directory operations.
- arm's __flush_dcache_page() is peculiar. What if the page lies beyond 4G?
- gss_wrap_req_priv() needs checking (snd_buf->page_base)
Cc: Oleg Drokin <green@linuxhacker.ru>
Cc: David Howells <dhowells@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: <reiserfs-dev@namesys.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Anton Altaparmakov <aia21@cantab.net>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Roman Zippel <zippel@linux-m68k.org>
Cc: <linux-fsdevel@vger.kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---
fs/afs/dir.c | 2 +-
fs/buffer.c | 6 +++---
fs/freevxfs/vxfs_immed.c | 4 ++--
fs/jffs/inode-v23.c | 4 ++--
fs/mpage.c | 4 ++--
fs/romfs/inode.c | 6 +++---
fs/smbfs/file.c | 4 ++--
fs/sysv/dir.c | 4 ++--
8 files changed, 17 insertions(+), 17 deletions(-)
diff -puN fs/afs/dir.c~fix-possible-page_cache_shift-overflows fs/afs/dir.c
--- devel/fs/afs/dir.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/afs/dir.c 2006-01-08 00:56:54.000000000 -0800
@@ -137,7 +137,7 @@ static inline void afs_dir_check_page(st
#endif
/* determine how many magic numbers there should be in this page */
- latter = dir->i_size - (page->index << PAGE_CACHE_SHIFT);
+ latter = dir->i_size - page_offset(page);
if (latter >= PAGE_SIZE)
qty = PAGE_SIZE;
else
diff -puN fs/buffer.c~fix-possible-page_cache_shift-overflows fs/buffer.c
--- devel/fs/buffer.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/buffer.c 2006-01-08 00:56:54.000000000 -0800
@@ -1762,7 +1762,7 @@ static int __block_write_full_page(struc
* handle that here by just cleaning them.
*/
- block = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+ block = (sector_t)page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
head = page_buffers(page);
bh = head;
@@ -2635,7 +2635,7 @@ int block_truncate_page(struct address_s
pgoff_t index = from >> PAGE_CACHE_SHIFT;
unsigned offset = from & (PAGE_CACHE_SIZE-1);
unsigned blocksize;
- pgoff_t iblock;
+ sector_t iblock;
unsigned length, pos;
struct inode *inode = mapping->host;
struct page *page;
@@ -2651,7 +2651,7 @@ int block_truncate_page(struct address_s
return 0;
length = blocksize - length;
- iblock = index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+ iblock = (sector_t)index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
page = grab_cache_page(mapping, index);
err = -ENOMEM;
diff -puN fs/freevxfs/vxfs_immed.c~fix-possible-page_cache_shift-overflows fs/freevxfs/vxfs_immed.c
--- devel/fs/freevxfs/vxfs_immed.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/freevxfs/vxfs_immed.c 2006-01-08 00:56:54.000000000 -0800
@@ -99,8 +99,8 @@ static int
vxfs_immed_readpage(struct file *fp, struct page *pp)
{
struct vxfs_inode_info *vip = VXFS_INO(pp->mapping->host);
- u_int64_t offset = pp->index << PAGE_CACHE_SHIFT;
- caddr_t kaddr;
+ u_int64_t offset = (u_int64_t)pp->index << PAGE_CACHE_SHIFT;
+ caddr_t kaddr;
kaddr = kmap(pp);
memcpy(kaddr, vip->vii_immed.vi_immed + offset, PAGE_CACHE_SIZE);
diff -puN fs/jffs/inode-v23.c~fix-possible-page_cache_shift-overflows fs/jffs/inode-v23.c
--- devel/fs/jffs/inode-v23.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/jffs/inode-v23.c 2006-01-08 00:56:54.000000000 -0800
@@ -757,7 +757,7 @@ jffs_do_readpage_nolock(struct file *fil
read_len = 0;
result = 0;
- offset = page->index << PAGE_CACHE_SHIFT;
+ offset = page_offset(page);
kmap(page);
buf = page_address(page);
@@ -1545,7 +1545,7 @@ jffs_commit_write(struct file *filp, str
{
void *addr = page_address(page) + from;
/* XXX: PAGE_CACHE_SHIFT or PAGE_SHIFT */
- loff_t pos = (page->index<<PAGE_CACHE_SHIFT) + from;
+ loff_t pos = page_offset(page) + from;
return jffs_file_write(filp, addr, to-from, &pos);
} /* jffs_commit_write() */
diff -puN fs/mpage.c~fix-possible-page_cache_shift-overflows fs/mpage.c
--- devel/fs/mpage.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/mpage.c 2006-01-08 00:56:54.000000000 -0800
@@ -184,7 +184,7 @@ do_mpage_readpage(struct bio *bio, struc
if (page_has_buffers(page))
goto confused;
- block_in_file = page->index << (PAGE_CACHE_SHIFT - blkbits);
+ block_in_file = (sector_t)page->index << (PAGE_CACHE_SHIFT - blkbits);
last_block = (i_size_read(inode) + blocksize - 1) >> blkbits;
bh.b_page = page;
@@ -466,7 +466,7 @@ __mpage_writepage(struct bio *bio, struc
* The page has no buffers: map it to disk
*/
BUG_ON(!PageUptodate(page));
- block_in_file = page->index << (PAGE_CACHE_SHIFT - blkbits);
+ block_in_file = (sector_t)page->index << (PAGE_CACHE_SHIFT - blkbits);
last_block = (i_size - 1) >> blkbits;
map_bh.b_page = page;
for (page_block = 0; page_block < blocks_per_page; ) {
diff -puN fs/romfs/inode.c~fix-possible-page_cache_shift-overflows fs/romfs/inode.c
--- devel/fs/romfs/inode.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/romfs/inode.c 2006-01-08 00:56:54.000000000 -0800
@@ -418,7 +418,7 @@ static int
romfs_readpage(struct file *file, struct page * page)
{
struct inode *inode = page->mapping->host;
- unsigned long offset, avail, readlen;
+ loff_t offset, avail, readlen;
void *buf;
int result = -EIO;
@@ -429,8 +429,8 @@ romfs_readpage(struct file *file, struct
goto err_out;
/* 32 bit warning -- but not for us :) */
- offset = page->index << PAGE_CACHE_SHIFT;
- if (offset < inode->i_size) {
+ offset = page_offset(page);
+ if (offset < i_size_read(inode)) {
avail = inode->i_size-offset;
readlen = min_t(unsigned long, avail, PAGE_SIZE);
if (romfs_copyfrom(inode, buf, ROMFS_I(inode)->i_dataoffset+offset, readlen) == readlen) {
diff -puN fs/smbfs/file.c~fix-possible-page_cache_shift-overflows fs/smbfs/file.c
--- devel/fs/smbfs/file.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/smbfs/file.c 2006-01-08 00:56:54.000000000 -0800
@@ -209,8 +209,8 @@ smb_updatepage(struct file *file, struct
{
struct dentry *dentry = file->f_dentry;
- DEBUG1("(%s/%s %d@%ld)\n", DENTRY_PATH(dentry),
- count, (page->index << PAGE_CACHE_SHIFT)+offset);
+ DEBUG1("(%s/%s %d@%lld)\n", DENTRY_PATH(dentry), count,
+ ((unsigned long long)page->index << PAGE_CACHE_SHIFT) + offset);
return smb_writepage_sync(dentry->d_inode, page, offset, count);
}
diff -puN fs/sysv/dir.c~fix-possible-page_cache_shift-overflows fs/sysv/dir.c
--- devel/fs/sysv/dir.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800
+++ devel-akpm/fs/sysv/dir.c 2006-01-08 00:56:54.000000000 -0800
@@ -103,7 +103,7 @@ static int sysv_readdir(struct file * fi
offset = (char *)de - kaddr;
over = filldir(dirent, name, strnlen(name,SYSV_NAMELEN),
- (n<<PAGE_CACHE_SHIFT) | offset,
+ ((loff_t)n<<PAGE_CACHE_SHIFT) | offset,
fs16_to_cpu(SYSV_SB(sb), de->inode),
DT_UNKNOWN);
if (over) {
@@ -115,7 +115,7 @@ static int sysv_readdir(struct file * fi
}
done:
- filp->f_pos = (n << PAGE_CACHE_SHIFT) | offset;
+ filp->f_pos = ((loff_t)n << PAGE_CACHE_SHIFT) | offset;
unlock_kernel();
return 0;
}
_
Patches currently in -mm which might be from akpm@osdl.org are
linus.patch
lxdialog-sane-colours.patch
git-acpi.patch
git-audit.patch
git-blkdev-fixup.patch
git-cfq-fixup.patch
git-drm-radeon-warning-fixes.patch
git-drm-build-fix.patch
git-drm-via_dmablit-build-fix.patch
git-libata-all-fixup.patch
git-libata-all-pata_amd-build-fix.patch
swsusp-resume-parsing-fix.patch
fix-sys-class-net-if-wireless-without-dev-get_wireless_stats-fix.patch
shrink-dentry-struct-spufs-fix.patch
revert-gregkh-pci-shot-accross-the-bow.patch
msix-save-restore-for-suspend-resume-fix.patch
git-scsi-misc-fixup.patch
git-sas-jg.patch
gregkh-usb-usbip-build-fix.patch
gregkh-usb-usbip-more-dead-code.patch
git-watchdog.patch
x86_64-cpufreq-constant-tsc-fix.patch
acx1xx-wireless-driver-usb-is-bust.patch
acx1xx-allow-modular-build.patch
acx1xx-wireless-driver-spy_offset-went-away.patch
tiacx-usb_driver-build-fix.patch
smbfs-readdir-vs-signal-fix.patch
ext3_readdir-use-generic-readahead.patch
jbd-fix-transaction-batching.patch
shrinks-sizeoffiles_struct-and-better-layout-tidy.patch
avoid-taking-global-tasklist_lock-for-single-threadedprocess-at-getrusage-tidy.patch
dump_thread-cleanup-fix.patch
remove-ext2-xattr-permission-checks-warning-fixes.patch
remove-xfs-xattr-permission-checks-warning-fixes.patch
replace-inode_update_time-with-file_update_time-switch-ntfs-to-touch_atime.patch
ocfs-update-atime-borkage.patch
mutex-subsystem-semaphore-to-mutex-vfs-i_sem-fixes.patch
edac-atomic-scrub-operations.patch
edac-with-sysfs-interface-added-tidy.patch
hrtimer-move-div_long_long_rem-out-of-jiffiesh-sparc64-fix.patch
hrtimer-export-deinlined-mktime.patch
time-fix-cpu-frequency-detection.patch
dlm-use-configfs-fix.patch
reiser4-only.patch
reiser4-swsusp-build-fix.patch
reiser4-printk-warning-fix.patch
reiser4-mm-remove-pg_highmem-fix.patch
reiser4-page-private-fixes.patch
reiser4-big-update-div64-fix.patch
reiser4-remove-c99isms.patch
reiser4_releasepage-gfp_t-fixes.patch
reiser4-big-update-update_atime-fixes.patch
add-sysfs-entry-to-disable-framebuffer-access-tidy.patch
non-linear-frame-buffer-read-write-access-tidy.patch
md-dm-reduce-stack-usage-with-stacked-block-devices-fixes.patch
nr_blockdev_pages-in_interrupt-warning.patch
sysfs-crash-debugging.patch
device-suspend-debug.patch
tty-layer-buffering-revamp-jsm-is-broken.patch
tty-layer-buffering-revamp-pmac_zilog-warning-fix.patch
tty-layer-buffering-revamp-sunsab-build-fix.patch
isicom-pci-probing-added-fix-vs-gregkh-pci-pci-driver-owner-removal.patch
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2006-01-09 6:30 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-01-09 6:29 - fix-possible-page_cache_shift-overflows.patch removed from -mm tree akpm
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).