From mboxrd@z Thu Jan 1 00:00:00 1970 From: akpm@linux-foundation.org Subject: [patch 11/21] vfs: explicitly cast s_maxbytes in fiemap_check_ranges Date: Fri, 18 Sep 2009 13:05:50 -0700 Message-ID: <200909182005.n8IK5pJv019392@imap1.linux-foundation.org> Mime-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Cc: linux-fsdevel@vger.kernel.org, akpm@linux-foundation.org, jlayton@redhat.com, hannes@cmpxchg.org, hch@lst.de, msb@google.com, rlove@google.com To: viro@zeniv.linux.org.uk Return-path: Received: from smtp1.linux-foundation.org ([140.211.169.13]:36935 "EHLO smtp1.linux-foundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758207AbZIRUMY (ORCPT ); Fri, 18 Sep 2009 16:12:24 -0400 Sender: linux-fsdevel-owner@vger.kernel.org List-ID: From: Jeff Layton If fiemap_check_ranges is passed a large enough value, then it's possible that the value would be cast to a signed value for comparison against s_maxbytes when we change it to loff_t. Make sure that doesn't happen by explicitly casting s_maxbytes to an unsigned value for the purposes of comparison. Signed-off-by: Jeff Layton Cc: Christoph Hellwig Cc: Robert Love Cc: Al Viro Cc: Johannes Weiner Cc: Mandeep Singh Baines Signed-off-by: Andrew Morton --- fs/ioctl.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff -puN fs/ioctl.c~vfs-explicitly-cast-s_maxbytes-in-fiemap_check_ranges fs/ioctl.c --- a/fs/ioctl.c~vfs-explicitly-cast-s_maxbytes-in-fiemap_check_ranges +++ a/fs/ioctl.c @@ -162,20 +162,21 @@ EXPORT_SYMBOL(fiemap_check_flags); static int fiemap_check_ranges(struct super_block *sb, u64 start, u64 len, u64 *new_len) { + u64 maxbytes = (u64) sb->s_maxbytes; + *new_len = len; if (len == 0) return -EINVAL; - if (start > sb->s_maxbytes) + if (start > maxbytes) return -EFBIG; /* * Shrink request scope to what the fs can actually handle. */ - if ((len > sb->s_maxbytes) || - (sb->s_maxbytes - len) < start) - *new_len = sb->s_maxbytes - start; + if (len > maxbytes || (maxbytes - len) < start) + *new_len = maxbytes - start; return 0; } _