On Wed, Nov 06, 2019 at 08:04:00PM +0100, Andreas Gruenbacher wrote:
> On architectures where ssize_t is wider than pgoff_t, the expression
ssize_t? But you're changing @offset, which is loff_t. I'm confused.
Also, which architectures are you talking about here?
--D
> ((page->index + 1) << PAGE_SHIFT) can overflow. Rewrite to use the page
> offset, which we already compute here anyway.
>
> Signed-off-by: Andreas Gruenbacher <agruenba@xxxxxxxxxx>
> ---
> fs/iomap/buffered-io.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
> index e25901ae3ff4..a30ea7ecb790 100644
> --- a/fs/iomap/buffered-io.c
> +++ b/fs/iomap/buffered-io.c
> @@ -1040,20 +1040,19 @@ vm_fault_t iomap_page_mkwrite(struct vm_fault *vmf, const struct iomap_ops *ops)
>
> lock_page(page);
> size = i_size_read(inode);
> - if ((page->mapping != inode->i_mapping) ||
> - (page_offset(page) > size)) {
> + offset = page_offset(page);
> + if (page->mapping != inode->i_mapping || offset > size) {
> /* We overload EFAULT to mean page got truncated */
> ret = -EFAULT;
> goto out_unlock;
> }
>
> /* page is wholly or partially inside EOF */
> - if (((page->index + 1) << PAGE_SHIFT) > size)
> + if (offset > size - PAGE_SIZE)
> length = offset_in_page(size);
> else
> length = PAGE_SIZE;
>
> - offset = page_offset(page);
> while (length > 0) {
> ret = iomap_apply(inode, offset, length,
> IOMAP_WRITE | IOMAP_FAULT, ops, page,
> --
> 2.20.1
>
