[PATCH v2] hugetlbfs: avoid overflow in hugetlbfs_fallocate

[PATCH v2] hugetlbfs: avoid overflow in hugetlbfs_fallocate

[yangerkun]

luojiajun report a problem[1] two years ago which seems still exists in
mainline. vfs_fallocate can avoid 'offset + len' trigger overflow, but
'offset + len + hpage_size - 1' may overflow too and will lead to a
wrong 'end'. luojiajun give a solution which can fix the wrong 'end'
but leave the overflow still happened. Fix it with DIV_ROUND_UP_ULL.

[1] https://patchwork.kernel.org/project/linux-mm/patch/1554775226-67213-1-git-send-email-luojiajun3@huawei.com/

Signed-off-by: yangerkun <yangerkun@huawei.com>
---
 fs/hugetlbfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 49d2e686be74..92ac056e8011 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -651,7 +651,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
 	 * as well as being converted to page offsets.
 	 */
 	start = offset >> hpage_shift;
-	end = (offset + len + hpage_size - 1) >> hpage_shift;
+	end = DIV_ROUND_UP_ULL(offset + len, hpage_size);
 
 	inode_lock(inode);
 
-- 
2.31.1

Re: [PATCH v2] hugetlbfs: avoid overflow in hugetlbfs_fallocate

[Mike Kravetz]

On 11/23/21 22:24, yangerkun wrote:
> luojiajun report a problem[1] two years ago which seems still exists in
> mainline. vfs_fallocate can avoid 'offset + len' trigger overflow, but
> 'offset + len + hpage_size - 1' may overflow too and will lead to a
> wrong 'end'. luojiajun give a solution which can fix the wrong 'end'
> but leave the overflow still happened. Fix it with DIV_ROUND_UP_ULL.
> 
> [1] https://patchwork.kernel.org/project/linux-mm/patch/1554775226-67213-1-git-send-email-luojiajun3@huawei.com/
> 
> Signed-off-by: yangerkun <yangerkun@huawei.com>
> ---
>  fs/hugetlbfs/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Thank you for fixing!

Matthew, thanks for DIV_ROUND_UP_ULL!  I did not know that existed.

Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>

-- 
Mike Kravetz