Re: [PATCH v2] xfs: fix possible overflow in xfs_ioc_trim()

[Christoph Hellwig <hch@xxxxxxxxxxxxx>]

On Tue, Sep 06, 2011 at 05:29:37PM +0200, Lukas Czerner wrote:
> In xfs_ioc_trim it is possible that start+len might overflow. Fix it by
> decrementing the len so that start+len equals to the file system size in
> the worst case.
> 
> Signed-off-by: Lukas Czerner <lczerner@xxxxxxxxxx>

> @@ -146,6 +146,7 @@ xfs_ioc_trim(
>       unsigned int            granularity = q->limits.discard_granularity;
>       struct fstrim_range     range;
>       xfs_fsblock_t           start, len, minlen;
> +     xfs_fsblock_t           max_blks = mp->m_sb.sb_dblocks;
>       xfs_agnumber_t          start_agno, end_agno, agno;
>       __uint64_t              blocks_trimmed = 0;
>       int                     error, last_error = 0;
> @@ -171,7 +172,8 @@ xfs_ioc_trim(
>       start_agno = XFS_FSB_TO_AGNO(mp, start);
>       if (start_agno >= mp->m_sb.sb_agcount)
>               return -XFS_ERROR(EINVAL);
> -
> +     if (len > max_blks)
> +             len = max_blks - start;

Is this really the correct check?

Shouldn't it be

        if (start + len > max_blks)
                len = max_blks - start;

I'd also just use the mp->m_sb.sb_dblocks value directly instead
of assigning it to a local variable.