On Wed 06-11-19 20:02:39, Andreas Gruenbacher wrote:
> On architectures where ssize_t is wider than pgoff_t, the expression
> ((page->index + 1) << PAGE_SHIFT) can overflow. Rewrite to use the page
> offset, which we already compute here anyway.
>
> Signed-off-by: Andreas Gruenbacher <agruenba@xxxxxxxxxx>
This patch seems to have fallen through the cracks? Al?
Honza
> ---
> fs/buffer.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 86a38b979323..da3f33b70249 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -2459,21 +2459,21 @@ int block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
> struct page *page = vmf->page;
> struct inode *inode = file_inode(vma->vm_file);
> unsigned long end;
> - loff_t size;
> + loff_t offset, size;
> int ret;
>
> lock_page(page);
> size = i_size_read(inode);
> - if ((page->mapping != inode->i_mapping) ||
> - (page_offset(page) > size)) {
> + offset = page_offset(page);
> + if (page->mapping != inode->i_mapping || offset > size) {
> /* We overload EFAULT to mean page got truncated */
> ret = -EFAULT;
> goto out_unlock;
> }
>
> /* page is wholly or partially inside EOF */
> - if (((page->index + 1) << PAGE_SHIFT) > size)
> - end = size & ~PAGE_MASK;
> + if (offset > size - PAGE_SIZE)
> + end = offset_in_page(size);
> else
> end = PAGE_SIZE;
>
> --
> 2.20.1
>
--
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR
