Revision 9dcbeed4d7e11e1dcf5e55475de3754f0855d1c2 authored by David Sterba on 09 November 2015, 10:44:45 UTC, committed by Chris Mason on 25 November 2015, 13:19:50 UTC
The calculation of range length in btrfs_sync_file leads to signed overflow. This was caught by PaX gcc SIZE_OVERFLOW plugin. https://forums.grsecurity.net/viewtopic.php?f=1&t=4284 The fsync call passes 0 and LLONG_MAX, the range length does not fit to loff_t and overflows, but the value is converted to u64 so it silently works as expected. The minimal fix is a typecast to u64, switching functions to take (start, end) instead of (start, len) would be more intrusive. Coccinelle script found that there's one more opencoded calculation of the length. <smpl> @@ loff_t start, end; @@ * end - start </smpl> CC: stable@vger.kernel.org Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Chris Mason <clm@fb.com>
1 parent d5f2e33
| File | Mode | Size |
|---|---|---|
| kasan | ||
| Kconfig | -rw-r--r-- | 22.7 KB |
| Kconfig.debug | -rw-r--r-- | 1.2 KB |
| Makefile | -rw-r--r-- | 2.7 KB |
| backing-dev.c | -rw-r--r-- | 25.5 KB |
| balloon_compaction.c | -rw-r--r-- | 6.8 KB |
| bootmem.c | -rw-r--r-- | 21.0 KB |
| cleancache.c | -rw-r--r-- | 9.9 KB |
| cma.c | -rw-r--r-- | 12.1 KB |
| cma.h | -rw-r--r-- | 515 bytes |
| cma_debug.c | -rw-r--r-- | 4.4 KB |
| compaction.c | -rw-r--r-- | 48.3 KB |
| debug-pagealloc.c | -rw-r--r-- | 2.6 KB |
| debug.c | -rw-r--r-- | 6.6 KB |
| dmapool.c | -rw-r--r-- | 13.9 KB |
| early_ioremap.c | -rw-r--r-- | 6.2 KB |
| fadvise.c | -rw-r--r-- | 3.7 KB |
| failslab.c | -rw-r--r-- | 1.3 KB |
| filemap.c | -rw-r--r-- | 70.7 KB |
| frame_vector.c | -rw-r--r-- | 6.2 KB |
| frontswap.c | -rw-r--r-- | 14.3 KB |
| gup.c | -rw-r--r-- | 39.8 KB |
| highmem.c | -rw-r--r-- | 11.8 KB |
| huge_memory.c | -rw-r--r-- | 81.3 KB |
| hugetlb.c | -rw-r--r-- | 114.6 KB |
| hugetlb_cgroup.c | -rw-r--r-- | 10.4 KB |
| hwpoison-inject.c | -rw-r--r-- | 3.2 KB |
| init-mm.c | -rw-r--r-- | 619 bytes |
| internal.h | -rw-r--r-- | 13.8 KB |
| interval_tree.c | -rw-r--r-- | 3.1 KB |
| kmemcheck.c | -rw-r--r-- | 2.9 KB |
| kmemleak-test.c | -rw-r--r-- | 3.2 KB |
| kmemleak.c | -rw-r--r-- | 54.5 KB |
| ksm.c | -rw-r--r-- | 63.3 KB |
| list_lru.c | -rw-r--r-- | 12.2 KB |
| maccess.c | -rw-r--r-- | 2.8 KB |
| madvise.c | -rw-r--r-- | 13.9 KB |
| memblock.c | -rw-r--r-- | 47.8 KB |
| memcontrol.c | -rw-r--r-- | 146.5 KB |
| memory-failure.c | -rw-r--r-- | 48.9 KB |
| memory.c | -rw-r--r-- | 104.9 KB |
| memory_hotplug.c | -rw-r--r-- | 51.9 KB |
| mempolicy.c | -rw-r--r-- | 70.6 KB |
| mempool.c | -rw-r--r-- | 13.9 KB |
| memtest.c | -rw-r--r-- | 2.7 KB |
| migrate.c | -rw-r--r-- | 47.3 KB |
| mincore.c | -rw-r--r-- | 6.6 KB |
| mlock.c | -rw-r--r-- | 19.6 KB |
| mm_init.c | -rw-r--r-- | 4.9 KB |
| mmap.c | -rw-r--r-- | 90.1 KB |
| mmu_context.c | -rw-r--r-- | 1.3 KB |
| mmu_notifier.c | -rw-r--r-- | 11.7 KB |
| mmzone.c | -rw-r--r-- | 2.3 KB |
| mprotect.c | -rw-r--r-- | 10.9 KB |
| mremap.c | -rw-r--r-- | 15.1 KB |
| msync.c | -rw-r--r-- | 2.6 KB |
| nobootmem.c | -rw-r--r-- | 11.1 KB |
| nommu.c | -rw-r--r-- | 51.9 KB |
| oom_kill.c | -rw-r--r-- | 20.0 KB |
| page-writeback.c | -rw-r--r-- | 83.1 KB |
| page_alloc.c | -rw-r--r-- | 193.8 KB |
| page_counter.c | -rw-r--r-- | 4.8 KB |
| page_ext.c | -rw-r--r-- | 10.4 KB |
| page_idle.c | -rw-r--r-- | 5.4 KB |
| page_io.c | -rw-r--r-- | 9.2 KB |
| page_isolation.c | -rw-r--r-- | 8.3 KB |
| page_owner.c | -rw-r--r-- | 7.1 KB |
| pagewalk.c | -rw-r--r-- | 7.5 KB |
| percpu-km.c | -rw-r--r-- | 2.8 KB |
| percpu-vm.c | -rw-r--r-- | 10.0 KB |
| percpu.c | -rw-r--r-- | 66.1 KB |
| pgtable-generic.c | -rw-r--r-- | 5.7 KB |
| process_vm_access.c | -rw-r--r-- | 9.8 KB |
| quicklist.c | -rw-r--r-- | 2.4 KB |
| readahead.c | -rw-r--r-- | 15.6 KB |
| rmap.c | -rw-r--r-- | 47.1 KB |
| shmem.c | -rw-r--r-- | 89.6 KB |
| slab.c | -rw-r--r-- | 107.7 KB |
| slab.h | -rw-r--r-- | 10.8 KB |
| slab_common.c | -rw-r--r-- | 28.3 KB |
| slob.c | -rw-r--r-- | 16.0 KB |
| slub.c | -rw-r--r-- | 129.8 KB |
| sparse-vmemmap.c | -rw-r--r-- | 6.0 KB |
| sparse.c | -rw-r--r-- | 20.9 KB |
| swap.c | -rw-r--r-- | 32.1 KB |
| swap_cgroup.c | -rw-r--r-- | 4.6 KB |
| swap_state.c | -rw-r--r-- | 13.1 KB |
| swapfile.c | -rw-r--r-- | 77.7 KB |
| truncate.c | -rw-r--r-- | 23.7 KB |
| userfaultfd.c | -rw-r--r-- | 7.2 KB |
| util.c | -rw-r--r-- | 10.9 KB |
| vmacache.c | -rw-r--r-- | 3.1 KB |
| vmalloc.c | -rw-r--r-- | 69.0 KB |
| vmpressure.c | -rw-r--r-- | 11.4 KB |
| vmscan.c | -rw-r--r-- | 110.9 KB |
| vmstat.c | -rw-r--r-- | 40.7 KB |
| workingset.c | -rw-r--r-- | 13.6 KB |
| zbud.c | -rw-r--r-- | 18.2 KB |
| zpool.c | -rw-r--r-- | 9.9 KB |
| zsmalloc.c | -rw-r--r-- | 47.6 KB |
| zswap.c | -rw-r--r-- | 32.0 KB |
Computing file changes ...
