diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2024-03-25 10:53:39 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2024-03-25 10:53:39 -0700 |
| commit | 928a87efa42302a23bb9554be081a28058495f22 (patch) | |
| tree | 6077ca871b08580c0e8486aa3b09fa9bdbc7ee3d /fs | |
| parent | 174fdc93a241af54772ae3e745ec719e9f6cebfc (diff) | |
| parent | c95346ac918c5badf51b9a7ac58a26d3bd5bb224 (diff) | |
Merge tag 'gfs2-v6.8-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2
Pull gfs2 fix from Andreas Gruenbacher:
- Fix boundary check in punch_hole
* tag 'gfs2-v6.8-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:
gfs2: Fix invalid metadata access in punch_hole
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/gfs2/bmap.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index 789af5c8fade..aa1626955b2c 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -1718,7 +1718,8 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length) struct buffer_head *dibh, *bh; struct gfs2_holder rd_gh; unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift; - u64 lblock = (offset + (1 << bsize_shift) - 1) >> bsize_shift; + unsigned int bsize = 1 << bsize_shift; + u64 lblock = (offset + bsize - 1) >> bsize_shift; __u16 start_list[GFS2_MAX_META_HEIGHT]; __u16 __end_list[GFS2_MAX_META_HEIGHT], *end_list = NULL; unsigned int start_aligned, end_aligned; @@ -1729,7 +1730,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length) u64 prev_bnr = 0; __be64 *start, *end; - if (offset >= maxsize) { + if (offset + bsize - 1 >= maxsize) { /* * The starting point lies beyond the allocated metadata; * there are no blocks to deallocate. |