• Wei Fang's avatar
    f2fs: fix a dead loop in f2fs_fiemap() · b86e3307
    Wei Fang authored
    A dead loop can be triggered in f2fs_fiemap() using the test case
    as below:
    
    	...
    	fd = open();
    	fallocate(fd, 0, 0, 4294967296);
    	ioctl(fd, FS_IOC_FIEMAP, fiemap_buf);
    	...
    
    It's caused by an overflow in __get_data_block():
    	...
    	bh->b_size = map.m_len << inode->i_blkbits;
    	...
    map.m_len is an unsigned int, and bh->b_size is a size_t which is 64 bits
    on 64 bits archtecture, type conversion from an unsigned int to a size_t
    will result in an overflow.
    
    In the above-mentioned case, bh->b_size will be zero, and f2fs_fiemap()
    will call get_data_block() at block 0 again an again.
    
    Fix this by adding a force conversion before left shift.
    Signed-off-by: default avatarWei Fang <fangwei1@huawei.com>
    Acked-by: default avatarChao Yu <yuchao0@huawei.com>
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    b86e3307
data.c 49.1 KB