Commit 390c642e authored by Gao Xiang's avatar Gao Xiang Committed by Greg Kroah-Hartman
Browse files

staging: erofs: fix integer overflow on 32-bit platform



This patch fixes integer overflow on multiplication
of 32-bit `lcn' in z_erofs_map_blocks_iter.

Signed-off-by: default avatarGao Xiang <gaoxiang25@huawei.com>
Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent df1e3f1f
Loading
Loading
Loading
Loading
+4 −4
Original line number Diff line number Diff line
@@ -1513,7 +1513,7 @@ static erofs_off_t vle_get_logical_extent_head(
		*flags ^= EROFS_MAP_ZIPPED;
	case Z_EROFS_VLE_CLUSTER_TYPE_HEAD:
		/* clustersize should be a power of two */
		ofs = ((unsigned long long)lcn << clusterbits) +
		ofs = ((u64)lcn << clusterbits) +
			(le16_to_cpu(di->di_clusterofs) & (clustersize - 1));
		*pcn = le32_to_cpu(di->di_u.blkaddr);
		break;
@@ -1595,7 +1595,7 @@ int z_erofs_map_blocks_iter(struct inode *inode,
	/* by default, compressed */
	map->m_flags |= EROFS_MAP_ZIPPED;

	end = (u64)(lcn + 1) * clustersize;
	end = ((u64)lcn + 1) * clustersize;

	cluster_type = vle_cluster_type(di);

@@ -1611,7 +1611,7 @@ int z_erofs_map_blocks_iter(struct inode *inode,
		}

		if (ofs_rem > logical_cluster_ofs) {
			ofs = lcn * clustersize | logical_cluster_ofs;
			ofs = (u64)lcn * clustersize | logical_cluster_ofs;
			pcn = le32_to_cpu(di->di_u.blkaddr);
			break;
		}
@@ -1623,7 +1623,7 @@ int z_erofs_map_blocks_iter(struct inode *inode,
			err = -EIO;
			goto unmap_out;
		}
		end = (lcn-- * clustersize) | logical_cluster_ofs;
		end = ((u64)lcn-- * clustersize) | logical_cluster_ofs;
		/* fallthrough */
	case Z_EROFS_VLE_CLUSTER_TYPE_NONHEAD:
		/* get the correspoinding first chunk */