[PATCH -next v5 07/32] ext4: fix orig_mlen initialization in ext4_map_blocks()
Zhang Yi <[email protected]>
| Newsgroups | org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-ext4,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
From: Zhang Yi <[email protected]> Save orig_mlen after clamping map->m_len to INT_MAX. Otherwise, the unclamped value may be passed below, bypassing its overflow protection. Fixes: 5bb12b1837c0 ("ext4: Add support for EXT4_GET_BLOCKS_QUERY_LEAF_BLOCKS") Signed-off-by: Zhang Yi <[email protected]> --- fs/ext4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 548a3968c5a7..bb4f1079d989 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -703,7 +703,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode, struct extent_status es; int retval; int ret = 0; - unsigned int orig_mlen = map->m_len; + unsigned int orig_mlen; #ifdef ES_AGGRESSIVE_TEST struct ext4_map_blocks orig_map; @@ -719,6 +719,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode, */ if (unlikely(map->m_len > INT_MAX)) map->m_len = INT_MAX; + orig_mlen = map->m_len; /* We can handle the block number less than EXT_MAX_BLOCKS */ if (unlikely(map->m_lblk >= EXT_MAX_BLOCKS)) -- 2.52.0