From mboxrd@z Thu Jan 1 00:00:00 1970 From: akpm@osdl.org Subject: - fix-possible-page_cache_shift-overflows.patch removed from -mm tree Date: Sun, 08 Jan 2006 22:29:28 -0800 Message-ID: <200601090629.k096Te7B022430@shell0.pdx.osdl.net> Return-path: Received: from smtp.osdl.org ([65.172.181.4]:33185 "EHLO smtp.osdl.org") by vger.kernel.org with ESMTP id S932865AbWAIGa2 (ORCPT ); Mon, 9 Jan 2006 01:30:28 -0500 To: akpm@osdl.org, aia21@cantab.net, blaisorblade@yahoo.it, dhowells@redhat.com, dwmw2@infradead.org, green@linuxhacker.ru, hch@lst.de, jdike@addtoit.com, linux-fsdevel@vger.kernel.org, miklos@szeredi.hu, neilb@cse.unsw.edu.au, reiserfs-dev@namesys.com, rmk@arm.linux.org.uk, trond.myklebust@fys.uio.no, zippel@linux-m68k.org, mm-commits@vger.kernel.org Sender: linux-fsdevel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org The patch titled fix possible PAGE_CACHE_SHIFT overflows has been removed from the -mm tree. Its filename is fix-possible-page_cache_shift-overflows.patch This patch was probably dropped from -mm because it has already been merged into a subsystem tree or into Linus's tree From: Andrew Morton We've had two instances recently of overflows when doing 64_bit_value = (32_bit_value << PAGE_CACHE_SHIFT) I did a tree-wide grep of `<<.*PAGE_CACHE_SHIFT' and this is the result. - afs_rxfs_fetch_descriptor.offset is of type off_t, which seems broken. - jfs and jffs are limited to 4GB anyway. - reiserfs map_block_for_writepage() takes an unsigned long for the block - it should take sector_t. (It'll fail for huge filesystems with blocksizepage_base) Cc: Oleg Drokin Cc: David Howells Cc: David Woodhouse Cc: Cc: Christoph Hellwig Cc: Anton Altaparmakov Cc: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Cc: Roman Zippel Cc: Cc: Miklos Szeredi Cc: Russell King Cc: Trond Myklebust Cc: Neil Brown Signed-off-by: Andrew Morton --- fs/afs/dir.c | 2 +- fs/buffer.c | 6 +++--- fs/freevxfs/vxfs_immed.c | 4 ++-- fs/jffs/inode-v23.c | 4 ++-- fs/mpage.c | 4 ++-- fs/romfs/inode.c | 6 +++--- fs/smbfs/file.c | 4 ++-- fs/sysv/dir.c | 4 ++-- 8 files changed, 17 insertions(+), 17 deletions(-) diff -puN fs/afs/dir.c~fix-possible-page_cache_shift-overflows fs/afs/dir.c --- devel/fs/afs/dir.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800 +++ devel-akpm/fs/afs/dir.c 2006-01-08 00:56:54.000000000 -0800 @@ -137,7 +137,7 @@ static inline void afs_dir_check_page(st #endif /* determine how many magic numbers there should be in this page */ - latter = dir->i_size - (page->index << PAGE_CACHE_SHIFT); + latter = dir->i_size - page_offset(page); if (latter >= PAGE_SIZE) qty = PAGE_SIZE; else diff -puN fs/buffer.c~fix-possible-page_cache_shift-overflows fs/buffer.c --- devel/fs/buffer.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800 +++ devel-akpm/fs/buffer.c 2006-01-08 00:56:54.000000000 -0800 @@ -1762,7 +1762,7 @@ static int __block_write_full_page(struc * handle that here by just cleaning them. */ - block = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits); + block = (sector_t)page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits); head = page_buffers(page); bh = head; @@ -2635,7 +2635,7 @@ int block_truncate_page(struct address_s pgoff_t index = from >> PAGE_CACHE_SHIFT; unsigned offset = from & (PAGE_CACHE_SIZE-1); unsigned blocksize; - pgoff_t iblock; + sector_t iblock; unsigned length, pos; struct inode *inode = mapping->host; struct page *page; @@ -2651,7 +2651,7 @@ int block_truncate_page(struct address_s return 0; length = blocksize - length; - iblock = index << (PAGE_CACHE_SHIFT - inode->i_blkbits); + iblock = (sector_t)index << (PAGE_CACHE_SHIFT - inode->i_blkbits); page = grab_cache_page(mapping, index); err = -ENOMEM; diff -puN fs/freevxfs/vxfs_immed.c~fix-possible-page_cache_shift-overflows fs/freevxfs/vxfs_immed.c --- devel/fs/freevxfs/vxfs_immed.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800 +++ devel-akpm/fs/freevxfs/vxfs_immed.c 2006-01-08 00:56:54.000000000 -0800 @@ -99,8 +99,8 @@ static int vxfs_immed_readpage(struct file *fp, struct page *pp) { struct vxfs_inode_info *vip = VXFS_INO(pp->mapping->host); - u_int64_t offset = pp->index << PAGE_CACHE_SHIFT; - caddr_t kaddr; + u_int64_t offset = (u_int64_t)pp->index << PAGE_CACHE_SHIFT; + caddr_t kaddr; kaddr = kmap(pp); memcpy(kaddr, vip->vii_immed.vi_immed + offset, PAGE_CACHE_SIZE); diff -puN fs/jffs/inode-v23.c~fix-possible-page_cache_shift-overflows fs/jffs/inode-v23.c --- devel/fs/jffs/inode-v23.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800 +++ devel-akpm/fs/jffs/inode-v23.c 2006-01-08 00:56:54.000000000 -0800 @@ -757,7 +757,7 @@ jffs_do_readpage_nolock(struct file *fil read_len = 0; result = 0; - offset = page->index << PAGE_CACHE_SHIFT; + offset = page_offset(page); kmap(page); buf = page_address(page); @@ -1545,7 +1545,7 @@ jffs_commit_write(struct file *filp, str { void *addr = page_address(page) + from; /* XXX: PAGE_CACHE_SHIFT or PAGE_SHIFT */ - loff_t pos = (page->index<index << (PAGE_CACHE_SHIFT - blkbits); + block_in_file = (sector_t)page->index << (PAGE_CACHE_SHIFT - blkbits); last_block = (i_size_read(inode) + blocksize - 1) >> blkbits; bh.b_page = page; @@ -466,7 +466,7 @@ __mpage_writepage(struct bio *bio, struc * The page has no buffers: map it to disk */ BUG_ON(!PageUptodate(page)); - block_in_file = page->index << (PAGE_CACHE_SHIFT - blkbits); + block_in_file = (sector_t)page->index << (PAGE_CACHE_SHIFT - blkbits); last_block = (i_size - 1) >> blkbits; map_bh.b_page = page; for (page_block = 0; page_block < blocks_per_page; ) { diff -puN fs/romfs/inode.c~fix-possible-page_cache_shift-overflows fs/romfs/inode.c --- devel/fs/romfs/inode.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800 +++ devel-akpm/fs/romfs/inode.c 2006-01-08 00:56:54.000000000 -0800 @@ -418,7 +418,7 @@ static int romfs_readpage(struct file *file, struct page * page) { struct inode *inode = page->mapping->host; - unsigned long offset, avail, readlen; + loff_t offset, avail, readlen; void *buf; int result = -EIO; @@ -429,8 +429,8 @@ romfs_readpage(struct file *file, struct goto err_out; /* 32 bit warning -- but not for us :) */ - offset = page->index << PAGE_CACHE_SHIFT; - if (offset < inode->i_size) { + offset = page_offset(page); + if (offset < i_size_read(inode)) { avail = inode->i_size-offset; readlen = min_t(unsigned long, avail, PAGE_SIZE); if (romfs_copyfrom(inode, buf, ROMFS_I(inode)->i_dataoffset+offset, readlen) == readlen) { diff -puN fs/smbfs/file.c~fix-possible-page_cache_shift-overflows fs/smbfs/file.c --- devel/fs/smbfs/file.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800 +++ devel-akpm/fs/smbfs/file.c 2006-01-08 00:56:54.000000000 -0800 @@ -209,8 +209,8 @@ smb_updatepage(struct file *file, struct { struct dentry *dentry = file->f_dentry; - DEBUG1("(%s/%s %d@%ld)\n", DENTRY_PATH(dentry), - count, (page->index << PAGE_CACHE_SHIFT)+offset); + DEBUG1("(%s/%s %d@%lld)\n", DENTRY_PATH(dentry), count, + ((unsigned long long)page->index << PAGE_CACHE_SHIFT) + offset); return smb_writepage_sync(dentry->d_inode, page, offset, count); } diff -puN fs/sysv/dir.c~fix-possible-page_cache_shift-overflows fs/sysv/dir.c --- devel/fs/sysv/dir.c~fix-possible-page_cache_shift-overflows 2006-01-08 00:56:54.000000000 -0800 +++ devel-akpm/fs/sysv/dir.c 2006-01-08 00:56:54.000000000 -0800 @@ -103,7 +103,7 @@ static int sysv_readdir(struct file * fi offset = (char *)de - kaddr; over = filldir(dirent, name, strnlen(name,SYSV_NAMELEN), - (n<inode), DT_UNKNOWN); if (over) { @@ -115,7 +115,7 @@ static int sysv_readdir(struct file * fi } done: - filp->f_pos = (n << PAGE_CACHE_SHIFT) | offset; + filp->f_pos = ((loff_t)n << PAGE_CACHE_SHIFT) | offset; unlock_kernel(); return 0; } _ Patches currently in -mm which might be from akpm@osdl.org are linus.patch lxdialog-sane-colours.patch git-acpi.patch git-audit.patch git-blkdev-fixup.patch git-cfq-fixup.patch git-drm-radeon-warning-fixes.patch git-drm-build-fix.patch git-drm-via_dmablit-build-fix.patch git-libata-all-fixup.patch git-libata-all-pata_amd-build-fix.patch swsusp-resume-parsing-fix.patch fix-sys-class-net-if-wireless-without-dev-get_wireless_stats-fix.patch shrink-dentry-struct-spufs-fix.patch revert-gregkh-pci-shot-accross-the-bow.patch msix-save-restore-for-suspend-resume-fix.patch git-scsi-misc-fixup.patch git-sas-jg.patch gregkh-usb-usbip-build-fix.patch gregkh-usb-usbip-more-dead-code.patch git-watchdog.patch x86_64-cpufreq-constant-tsc-fix.patch acx1xx-wireless-driver-usb-is-bust.patch acx1xx-allow-modular-build.patch acx1xx-wireless-driver-spy_offset-went-away.patch tiacx-usb_driver-build-fix.patch smbfs-readdir-vs-signal-fix.patch ext3_readdir-use-generic-readahead.patch jbd-fix-transaction-batching.patch shrinks-sizeoffiles_struct-and-better-layout-tidy.patch avoid-taking-global-tasklist_lock-for-single-threadedprocess-at-getrusage-tidy.patch dump_thread-cleanup-fix.patch remove-ext2-xattr-permission-checks-warning-fixes.patch remove-xfs-xattr-permission-checks-warning-fixes.patch replace-inode_update_time-with-file_update_time-switch-ntfs-to-touch_atime.patch ocfs-update-atime-borkage.patch mutex-subsystem-semaphore-to-mutex-vfs-i_sem-fixes.patch edac-atomic-scrub-operations.patch edac-with-sysfs-interface-added-tidy.patch hrtimer-move-div_long_long_rem-out-of-jiffiesh-sparc64-fix.patch hrtimer-export-deinlined-mktime.patch time-fix-cpu-frequency-detection.patch dlm-use-configfs-fix.patch reiser4-only.patch reiser4-swsusp-build-fix.patch reiser4-printk-warning-fix.patch reiser4-mm-remove-pg_highmem-fix.patch reiser4-page-private-fixes.patch reiser4-big-update-div64-fix.patch reiser4-remove-c99isms.patch reiser4_releasepage-gfp_t-fixes.patch reiser4-big-update-update_atime-fixes.patch add-sysfs-entry-to-disable-framebuffer-access-tidy.patch non-linear-frame-buffer-read-write-access-tidy.patch md-dm-reduce-stack-usage-with-stacked-block-devices-fixes.patch nr_blockdev_pages-in_interrupt-warning.patch sysfs-crash-debugging.patch device-suspend-debug.patch tty-layer-buffering-revamp-jsm-is-broken.patch tty-layer-buffering-revamp-pmac_zilog-warning-fix.patch tty-layer-buffering-revamp-sunsab-build-fix.patch isicom-pci-probing-added-fix-vs-gregkh-pci-pci-driver-owner-removal.patch