diff options
author | Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it> | 2005-12-29 11:39:57 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-12-29 12:48:15 -0500 |
commit | 30f04a4efa73dc80bf3f59f3f19ad5a24ac5ac0a (patch) | |
tree | 0f7f165bcf73bf26f782a2b56d05020ea6d4d5b0 /fs | |
parent | 3d0a07e3310c947c048bd01d8d0efa0e4fae5ba9 (diff) |
[PATCH] uml: hostfs - fix possible PAGE_CACHE_SHIFT overflows
Prevent page->index << PAGE_CACHE_SHIFT from overflowing.
There is a casting there, but was added without care, so it's at the wrong
place. Note the extra parens around the shift - "+" is higher precedence than
"<<", leading to a GCC warning which saved all us.
Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/hostfs/hostfs_kern.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c index 3aac164c7726..b3ad0bd0312f 100644 --- a/fs/hostfs/hostfs_kern.c +++ b/fs/hostfs/hostfs_kern.c | |||
@@ -501,11 +501,16 @@ int hostfs_commit_write(struct file *file, struct page *page, unsigned from, | |||
501 | long long start; | 501 | long long start; |
502 | int err = 0; | 502 | int err = 0; |
503 | 503 | ||
504 | start = (long long) (page->index << PAGE_CACHE_SHIFT) + from; | 504 | start = (((long long) page->index) << PAGE_CACHE_SHIFT) + from; |
505 | buffer = kmap(page); | 505 | buffer = kmap(page); |
506 | err = write_file(FILE_HOSTFS_I(file)->fd, &start, buffer + from, | 506 | err = write_file(FILE_HOSTFS_I(file)->fd, &start, buffer + from, |
507 | to - from); | 507 | to - from); |
508 | if(err > 0) err = 0; | 508 | if(err > 0) err = 0; |
509 | |||
510 | /* Actually, if !err, write_file has added to-from to start, so, despite | ||
511 | * the appearance, we are comparing i_size against the _last_ written | ||
512 | * location, as we should. */ | ||
513 | |||
509 | if(!err && (start > inode->i_size)) | 514 | if(!err && (start > inode->i_size)) |
510 | inode->i_size = start; | 515 | inode->i_size = start; |
511 | 516 | ||