Re: [PATCH v4 2/2] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

Namjae Jeon <[email protected]>
Newsgroups org.kernel.vger.linux-cifs,org.kernel.vger.stable
Message-ID <CAKYAXd-_CGXiYTo7OXQ=Lmo-tCv+gmi3HYOmyVkZ_GURoyJhnA@mail.gmail.com>
> @@ -1415,8 +1415,15 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
>          */
>         lock_two_nondirectories(target_inode, src_inode);
>
> -       if (len == 0)
> -               len = src_inode->i_size - off;
> +       if (len == 0) {
> +               loff_t src_size = i_size_read(src_inode);
> +
> +               if (off > src_size) {
> +                       rc = -EINVAL;
> +                       goto unlock;
> +               }
> +               len = src_size - off;
I have checked __generic_remap_file_range_prep(). Shouldn't this treat
off == src_size && len == 0 as a successful no-op ?

                    if (!len) {
                         rc = 0;
                         goto unlock;
                   }
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.