summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorUtako Kusaka <u-kusaka@wm.jp.nec.com>2011-07-27 22:11:20 -0400
committerTheodore Ts'o <tytso@mit.edu>2011-07-27 22:11:20 -0400
commit29ae07b702cb77dbc24b0843f15ee8cf8a642311 (patch)
tree4d9d3717e2be5cb335fd4f32c9207bf0b55caac9 /fs
parent0e1147b001793593624e80b3c0a1790822b6baca (diff)
downloadlinux-3.10-29ae07b702cb77dbc24b0843f15ee8cf8a642311.tar.gz
linux-3.10-29ae07b702cb77dbc24b0843f15ee8cf8a642311.tar.bz2
linux-3.10-29ae07b702cb77dbc24b0843f15ee8cf8a642311.zip
ext4: Fix overflow caused by missing cast in ext4_fallocate()
The logical block number in map.l_blk is a __u32, and so before we shift it left, by the block size, we neeed cast it to a 64-bit size. Otherwise i_size can be corrupted on an ENOSPC. # df -T /mnt/mp1 Filesystem Type 1K-blocks Used Available Use% Mounted on /dev/sda6 ext4 9843276 153056 9190200 2% /mnt/mp1 # fallocate -o 0 -l 2199023251456 /mnt/mp1/testfile fallocate: /mnt/mp1/testfile: fallocate failed: No space left on device # stat /mnt/mp1/testfile File: `/mnt/mp1/testfile' Size: 4293656576 Blocks: 19380440 IO Block: 4096 regular file Device: 806h/2054d Inode: 12 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2011-07-25 13:01:31.414490496 +0900 Modify: 2011-07-25 13:01:31.414490496 +0900 Change: 2011-07-25 13:01:31.454490495 +0900 Signed-off-by: Utako Kusaka <u-kusaka@wm.jp.nec.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> -- fs/ext4/extents.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
Diffstat (limited to 'fs')
-rw-r--r--fs/ext4/extents.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index a25bbdc7d49..57cf568a98a 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3824,7 +3824,7 @@ retry:
blkbits) >> blkbits))
new_size = offset + len;
else
- new_size = (map.m_lblk + ret) << blkbits;
+ new_size = ((loff_t) map.m_lblk + ret) << blkbits;
ext4_falloc_update_inode(inode, mode, new_size,
(map.m_flags & EXT4_MAP_NEW));