lkml.org 
[lkml]   [2015]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.1 65/84] ocfs2: fix shift left overflow
    Date
    4.1-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Joseph Qi <joseph.qi@huawei.com>

    commit 32e5a2a2be6b085febaac36efff495ad65a55e6c upstream.

    When using a large volume, for example 9T volume with 2T already used,
    frequent creation of small files with O_DIRECT when the IO is not
    cluster aligned may clear sectors in the wrong place. This will cause
    filesystem corruption.

    This is because p_cpos is a u32. When calculating the corresponding
    sector it should be converted to u64 first, otherwise it may overflow.

    Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
    Cc: Mark Fasheh <mfasheh@suse.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/ocfs2/aops.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/fs/ocfs2/aops.c
    +++ b/fs/ocfs2/aops.c
    @@ -686,7 +686,7 @@ static int ocfs2_direct_IO_zero_extend(s

    if (p_cpos && !(ext_flags & OCFS2_EXT_UNWRITTEN)) {
    u64 s = i_size_read(inode);
    - sector_t sector = (p_cpos << (osb->s_clustersize_bits - 9)) +
    + sector_t sector = ((u64)p_cpos << (osb->s_clustersize_bits - 9)) +
    (do_div(s, osb->s_clustersize) >> 9);

    ret = blkdev_issue_zeroout(osb->sb->s_bdev, sector,
    @@ -911,7 +911,7 @@ static ssize_t ocfs2_direct_IO_write(str
    BUG_ON(!p_cpos || (ext_flags & OCFS2_EXT_UNWRITTEN));

    ret = blkdev_issue_zeroout(osb->sb->s_bdev,
    - p_cpos << (osb->s_clustersize_bits - 9),
    + (u64)p_cpos << (osb->s_clustersize_bits - 9),
    zero_len_head >> 9, GFP_NOFS, false);
    if (ret < 0)
    mlog_errno(ret);



    \
     
     \ /
      Last update: 2015-08-14 20:41    [W:4.428 / U:0.888 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site