Commit c41570c9 authored by Justin Maggard's avatar Justin Maggard Committed by Chris Mason
Browse files

btrfs: fix defrag 32-bit integer overflow 



When defragging a very large file, the cluster variable can wrap its 32-bit
signed int type and become negative, which eventually gets passed to
btrfs_force_ra() as a very large unsigned long value.  On 32-bit platforms,
this eventually results in an Oops from the SLAB allocator.

Change the cluster and max_cluster signed int variables to unsigned long to
match the readahead functions.  This also allows the min() comparison in
btrfs_defrag_file() to work as intended.

Signed-off-by: default avatarJosef Bacik <jbacik@fb.com>
Signed-off-by: default avatarChris Mason <clm@fb.com>
parent c736c095

fs/btrfs/ioctl.c

+3 −3
Original line number Diff line number Diff line
@@ -1036,7 +1036,7 @@ out: 
static int cluster_pages_for_defrag(struct inode *inode,

				    struct page **pages,

				    unsigned long start_index,

				    int num_pages)

				    unsigned long num_pages)

{

	unsigned long file_end;

	u64 isize = i_size_read(inode);
@@ -1194,8 +1194,8 @@ int btrfs_defrag_file(struct inode *inode, struct file *file, 
	int defrag_count = 0;

	int compress_type = BTRFS_COMPRESS_ZLIB;

	int extent_thresh = range->extent_thresh;

	int max_cluster = (256 * 1024) >> PAGE_CACHE_SHIFT;

	int cluster = max_cluster;

	unsigned long max_cluster = (256 * 1024) >> PAGE_CACHE_SHIFT;

	unsigned long cluster = max_cluster;

	u64 new_align = ~((u64)128 * 1024 - 1);

	struct page **pages = NULL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE