xfs
[Top] [All Lists]

Re: [PATCH] xfs: fix possible overflow in xfs_ioc_trim()

To: Lukas Czerner <lczerner@xxxxxxxxxx>
Subject: Re: [PATCH] xfs: fix possible overflow in xfs_ioc_trim()
From: Chandra Seetharaman <sekharan@xxxxxxxxxx>
Date: Wed, 07 Sep 2011 09:13:53 -0500
Cc: xfs@xxxxxxxxxxx, hch@xxxxxxxxxxxxx
In-reply-to: <1315233205-27093-1-git-send-email-lczerner@xxxxxxxxxx>
Organization: IBM
References: <1315233205-27093-1-git-send-email-lczerner@xxxxxxxxxx>
Reply-to: sekharan@xxxxxxxxxx
On Mon, 2011-09-05 at 16:33 +0200, Lukas Czerner wrote:
> In xfs_ioc_trim it is possible that start+len might overflow. Fix it by
> decrementing the len so that start+len equals to the file system size in
> the worst case.
> 
> Signed-off-by: Lukas Czerner <lczerner@xxxxxxxxxx>
> ---
>  fs/xfs/xfs_discard.c |    4 +++-
>  1 files changed, 3 insertions(+), 1 deletions(-)
> 
> diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
> index 244e797..0fab107 100644
> --- a/fs/xfs/xfs_discard.c
> +++ b/fs/xfs/xfs_discard.c
> @@ -146,6 +146,7 @@ xfs_ioc_trim(
>       unsigned int            granularity = q->limits.discard_granularity;
>       struct fstrim_range     range;
>       xfs_fsblock_t           start, len, minlen;
> +     xfs_fsblock_t           max_blks =  XFS_MAX_DBLOCKS(&(mp->m_sb));
>       xfs_agnumber_t          start_agno, end_agno, agno;
>       __uint64_t              blocks_trimmed = 0;
>       int                     error, last_error = 0;
> @@ -171,7 +172,8 @@ xfs_ioc_trim(
>       start_agno = XFS_FSB_TO_AGNO(mp, start);
>       if (start_agno >= mp->m_sb.sb_agcount)
>               return -XFS_ERROR(EINVAL);
> -
> +     if (len > max_blks)

just wondering....

shouldn't this be ((start + len) > max_blks) ?

> +             len = max_blks - start;
>       end_agno = XFS_FSB_TO_AGNO(mp, start + len);
>       if (end_agno >= mp->m_sb.sb_agcount)
>               end_agno = mp->m_sb.sb_agcount - 1;


<Prev in Thread] Current Thread [Next in Thread>