Skip to content

Commit 6438ef3

Browse files
Nikita Zhandarovichakpm00
authored andcommitted
nilfs2: fix possible int overflows in nilfs_fiemap()
Since nilfs_bmap_lookup_contig() in nilfs_fiemap() calculates its result by being prepared to go through potentially maxblocks == INT_MAX blocks, the value in n may experience an overflow caused by left shift of blkbits. While it is extremely unlikely to occur, play it safe and cast right hand expression to wider type to mitigate the issue. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Link: https://lkml.kernel.org/r/20250124222133.5323-1-konishi.ryusuke@gmail.com Fixes: 622daaf ("nilfs2: fiemap support") Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
1 parent 6268f0a commit 6438ef3

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

fs/nilfs2/inode.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1186,7 +1186,7 @@ int nilfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
11861186
if (size) {
11871187
if (phys && blkphy << blkbits == phys + size) {
11881188
/* The current extent goes on */
1189-
size += n << blkbits;
1189+
size += (u64)n << blkbits;
11901190
} else {
11911191
/* Terminate the current extent */
11921192
ret = fiemap_fill_next_extent(
@@ -1199,14 +1199,14 @@ int nilfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
11991199
flags = FIEMAP_EXTENT_MERGED;
12001200
logical = blkoff << blkbits;
12011201
phys = blkphy << blkbits;
1202-
size = n << blkbits;
1202+
size = (u64)n << blkbits;
12031203
}
12041204
} else {
12051205
/* Start a new extent */
12061206
flags = FIEMAP_EXTENT_MERGED;
12071207
logical = blkoff << blkbits;
12081208
phys = blkphy << blkbits;
1209-
size = n << blkbits;
1209+
size = (u64)n << blkbits;
12101210
}
12111211
blkoff += n;
12121212
}

0 commit comments

Comments
 (0)