dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

fix some conversion overflows 

Fix page index to offset conversion overflows in buffer layer, ecryptfs,
and ocfs2.

It would be nice to convert the whole tree to page_offset, but for now
just fix the bugs.

Signed-off-by: Nick Piggin <npiggin@suse.de>
Cc: Michael Halcrow <mhalcrow@us.ibm.com>
Cc: Mark Fasheh <mark.fasheh@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Nick Piggin 2007-07-20 00:31:45 -07:00 committed by Linus Torvalds
parent e228929bc2
commit 1833633803
3 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/buffer.c
View File

@ -2221,7 +2221,7 @@ block_page_mkwrite(struct vm_area_struct *vma, struct page *page,
lock_page(page);
size = i_size_read(inode);
if ((page->mapping != inode->i_mapping) ||
((page->index << PAGE_CACHE_SHIFT) > size)) {
(page_offset(page) > size)) {
/* page got truncated out from underneath us */
goto out_unlock;
}

5
fs/ecryptfs/mmap.c
View File

@ -409,8 +409,7 @@ static int ecryptfs_prepare_write(struct file *file, struct page *page,
if (!PageUptodate(page))
rc = ecryptfs_do_readpage(file, page, page->index);
if (page->index != 0) {
loff_t end_of_prev_pg_pos =
(((loff_t)page->index << PAGE_CACHE_SHIFT) - 1);
loff_t end_of_prev_pg_pos = page_offset(page) - 1;
if (end_of_prev_pg_pos > i_size_read(page->mapping->host)) {
rc = ecryptfs_truncate(file->f_path.dentry,
@ -736,7 +735,7 @@ static int ecryptfs_commit_write(struct file *file, struct page *page,
goto out;
}
inode->i_blocks = lower_inode->i_blocks;
pos = (page->index << PAGE_CACHE_SHIFT) + to;
pos = page_offset(page) + to;
if (pos > i_size_read(inode)) {
i_size_write(inode, pos);
ecryptfs_printk(KERN_DEBUG, "Expanded file size to "

2
fs/ocfs2/mmap.c
View File

@ -89,7 +89,7 @@ static int __ocfs2_page_mkwrite(struct inode *inode, struct buffer_head *di_bh,
{
int ret;
struct address_space *mapping = inode->i_mapping;
loff_t pos = page->index << PAGE_CACHE_SHIFT;
loff_t pos = page_offset(page);
unsigned int len = PAGE_CACHE_SIZE;
pgoff_t last_index;
struct page *locked_page = NULL;