提交 75f1142f 编写于 作者: Y yangerkun 提交者: Zheng Zengkai

hugetlbfs: avoid overflow in hugetlbfs_fallocate

hulk inclusion
category: bugfix
bugzilla: 185798 https://gitee.com/openeuler/kernel/issues/I4JWYM
CVE: NA

---------------------------

luojiajun report a problem[1] two years ago which seems still exists in
mainline. vfs_fallocate can avoid 'offset + len' trigger overflow, but
'offset + len + hpage_size - 1' may overflow too and will lead to a
wrong 'end'. luojiajun give a solution which can fix the wrong 'end'
but leave the overflow still happened. Fix it with DIV_ROUND_UP_ULL.

[1] https://patchwork.kernel.org/project/linux-mm/patch/1554775226-67213-1-git-send-email-luojiajun3@huawei.com/Signed-off-by: Nyangerkun <yangerkun@huawei.com>
Reviewed-by: NZhang Yi <yi.zhang@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
上级 f78399e6
......@@ -655,7 +655,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
* as well as being converted to page offsets.
*/
start = offset >> hpage_shift;
end = (offset + len + hpage_size - 1) >> hpage_shift;
end = DIV_ROUND_UP_ULL(offset + len, hpage_size);
inode_lock(inode);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册