Commit 54b21a79 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds
Browse files

[PATCH] fix possible PAGE_CACHE_SHIFT overflows 



We've had two instances recently of overflows when doing

	64_bit_value = (32_bit_value << PAGE_CACHE_SHIFT)

I did a tree-wide grep of `<<.*PAGE_CACHE_SHIFT' and this is the result.

- afs_rxfs_fetch_descriptor.offset is of type off_t, which seems broken.

- jfs and jffs are limited to 4GB anyway.

- reiserfs map_block_for_writepage() takes an unsigned long for the block -
  it should take sector_t.  (It'll fail for huge filesystems with
  blocksize<PAGE_CACHE_SIZE)

- cramfs_read() needs to use sector_t (I think cramsfs is busted on large
  filesystems anyway)

- affs is limited in file size anyway.

- I generally didn't fix 32-bit overflows in directory operations.

- arm's __flush_dcache_page() is peculiar.  What if the page lies beyond 4G?

- gss_wrap_req_priv() needs checking (snd_buf->page_base)

Cc: Oleg Drokin <green@linuxhacker.ru>
Cc: David Howells <dhowells@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: <reiserfs-dev@namesys.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Anton Altaparmakov <aia21@cantab.net>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Roman Zippel <zippel@linux-m68k.org>
Cc: <linux-fsdevel@vger.kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 676121fc

fs/afs/dir.c

+1 −1
Original line number Diff line number Diff line
@@ -137,7 +137,7 @@ static inline void afs_dir_check_page(struct inode *dir, struct page *page) 
#endif



	/* determine how many magic numbers there should be in this page */

	latter = dir->i_size - (page->index << PAGE_CACHE_SHIFT);

	latter = dir->i_size - page_offset(page);

	if (latter >= PAGE_SIZE)

		qty = PAGE_SIZE;

	else

fs/buffer.c

+3 −3
Original line number Diff line number Diff line
@@ -1762,7 +1762,7 @@ static int __block_write_full_page(struct inode *inode, struct page *page, 
	 * handle that here by just cleaning them.

	 */



	block = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);

	block = (sector_t)page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);

	head = page_buffers(page);

	bh = head;
@@ -2635,7 +2635,7 @@ int block_truncate_page(struct address_space *mapping, 
	pgoff_t index = from >> PAGE_CACHE_SHIFT;

	unsigned offset = from & (PAGE_CACHE_SIZE-1);

	unsigned blocksize;

	pgoff_t iblock;

	sector_t iblock;

	unsigned length, pos;

	struct inode *inode = mapping->host;

	struct page *page;
@@ -2651,7 +2651,7 @@ int block_truncate_page(struct address_space *mapping, 
		return 0;



	length = blocksize - length;

	iblock = index << (PAGE_CACHE_SHIFT - inode->i_blkbits);

	iblock = (sector_t)index << (PAGE_CACHE_SHIFT - inode->i_blkbits);

	

	page = grab_cache_page(mapping, index);

	err = -ENOMEM;

fs/freevxfs/vxfs_immed.c

+2 −2
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ static int 
vxfs_immed_readpage(struct file *fp, struct page *pp)

{

	struct vxfs_inode_info	*vip = VXFS_INO(pp->mapping->host);

	u_int64_t		offset = pp->index << PAGE_CACHE_SHIFT;

	u_int64_t	offset = (u_int64_t)pp->index << PAGE_CACHE_SHIFT;

	caddr_t		kaddr;



	kaddr = kmap(pp);

fs/jffs/inode-v23.c

+2 −2
Original line number Diff line number Diff line
@@ -757,7 +757,7 @@ jffs_do_readpage_nolock(struct file *file, struct page *page) 


	read_len = 0;

	result = 0;

	offset = page->index << PAGE_CACHE_SHIFT;

	offset = page_offset(page);



	kmap(page);

	buf = page_address(page);
@@ -1545,7 +1545,7 @@ jffs_commit_write(struct file *filp, struct page *page, 
{

       void *addr = page_address(page) + from;

       /* XXX: PAGE_CACHE_SHIFT or PAGE_SHIFT */

       loff_t pos = (page->index<<PAGE_CACHE_SHIFT) + from;

       loff_t pos = page_offset(page) + from;



       return jffs_file_write(filp, addr, to-from, &pos);

} /* jffs_commit_write() */

fs/mpage.c

+2 −2
Original line number Diff line number Diff line
@@ -184,7 +184,7 @@ do_mpage_readpage(struct bio *bio, struct page *page, unsigned nr_pages, 
	if (page_has_buffers(page))

		goto confused;



	block_in_file = page->index << (PAGE_CACHE_SHIFT - blkbits);

	block_in_file = (sector_t)page->index << (PAGE_CACHE_SHIFT - blkbits);

	last_block = (i_size_read(inode) + blocksize - 1) >> blkbits;



	bh.b_page = page;
@@ -466,7 +466,7 @@ __mpage_writepage(struct bio *bio, struct page *page, get_block_t get_block, 
	 * The page has no buffers: map it to disk

	 */

	BUG_ON(!PageUptodate(page));

	block_in_file = page->index << (PAGE_CACHE_SHIFT - blkbits);

	block_in_file = (sector_t)page->index << (PAGE_CACHE_SHIFT - blkbits);

	last_block = (i_size - 1) >> blkbits;

	map_bh.b_page = page;

	for (page_block = 0; page_block < blocks_per_page; ) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE