aboutsummaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorLi Wang <liwang@nudt.edu.cn>2012-01-18 20:44:36 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-02-13 14:06:09 -0500
commit1a11d5d7fb7988a92e798dfbed7cdd350c0701cc (patch)
tree252c858c9b52ba6a819d8d27ce36af0dbbc861b2 /fs
parentdade9ad146b19c22141032d84190d2220623d2ca (diff)
eCryptfs: Infinite loop due to overflow in ecryptfs_write()
commit 684a3ff7e69acc7c678d1a1394fe9e757993fd34 upstream. ecryptfs_write() can enter an infinite loop when truncating a file to a size larger than 4G. This only happens on architectures where size_t is represented by 32 bits. This was caused by a size_t overflow due to it incorrectly being used to store the result of a calculation which uses potentially large values of type loff_t. [tyhicks@canonical.com: rewrite subject and commit message] Signed-off-by: Li Wang <liwang@nudt.edu.cn> Signed-off-by: Yunchuan Wen <wenyunchuan@kylinos.com.cn> Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/ecryptfs/read_write.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index 54eb14caad7..608c1c3fde1 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -130,7 +130,7 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
130 pgoff_t ecryptfs_page_idx = (pos >> PAGE_CACHE_SHIFT); 130 pgoff_t ecryptfs_page_idx = (pos >> PAGE_CACHE_SHIFT);
131 size_t start_offset_in_page = (pos & ~PAGE_CACHE_MASK); 131 size_t start_offset_in_page = (pos & ~PAGE_CACHE_MASK);
132 size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page); 132 size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
133 size_t total_remaining_bytes = ((offset + size) - pos); 133 loff_t total_remaining_bytes = ((offset + size) - pos);
134 134
135 if (fatal_signal_pending(current)) { 135 if (fatal_signal_pending(current)) {
136 rc = -EINTR; 136 rc = -EINTR;
@@ -141,7 +141,7 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
141 num_bytes = total_remaining_bytes; 141 num_bytes = total_remaining_bytes;
142 if (pos < offset) { 142 if (pos < offset) {
143 /* remaining zeros to write, up to destination offset */ 143 /* remaining zeros to write, up to destination offset */
144 size_t total_remaining_zeros = (offset - pos); 144 loff_t total_remaining_zeros = (offset - pos);
145 145
146 if (num_bytes > total_remaining_zeros) 146 if (num_bytes > total_remaining_zeros)
147 num_bytes = total_remaining_zeros; 147 num_bytes = total_remaining_zeros;