Re: [PATCH v4 2/2] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
Namjae Jeon <[email protected]>
| Newsgroups | org.kernel.vger.linux-cifs,org.kernel.vger.stable |
|---|---|
| Message-ID | <CAKYAXd-_CGXiYTo7OXQ=Lmo-tCv+gmi3HYOmyVkZ_GURoyJhnA@mail.gmail.com> |
> @@ -1415,8 +1415,15 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
> */
> lock_two_nondirectories(target_inode, src_inode);
>
> - if (len == 0)
> - len = src_inode->i_size - off;
> + if (len == 0) {
> + loff_t src_size = i_size_read(src_inode);
> +
> + if (off > src_size) {
> + rc = -EINVAL;
> + goto unlock;
> + }
> + len = src_size - off;
I have checked __generic_remap_file_range_prep(). Shouldn't this treat
off == src_size && len == 0 as a successful no-op ?
if (!len) {
rc = 0;
goto unlock;
}