From 30f04a4efa73dc80bf3f59f3f19ad5a24ac5ac0a Mon Sep 17 00:00:00 2001 From: Paolo 'Blaisorblade' Giarrusso Date: Thu, 29 Dec 2005 17:39:57 +0100 Subject: [PATCH] uml: hostfs - fix possible PAGE_CACHE_SHIFT overflows Prevent page->index << PAGE_CACHE_SHIFT from overflowing. There is a casting there, but was added without care, so it's at the wrong place. Note the extra parens around the shift - "+" is higher precedence than "<<", leading to a GCC warning which saved all us. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Linus Torvalds --- fs/hostfs/hostfs_kern.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'fs/hostfs/hostfs_kern.c') diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c index 3aac164c772..b3ad0bd0312 100644 --- a/fs/hostfs/hostfs_kern.c +++ b/fs/hostfs/hostfs_kern.c @@ -501,11 +501,16 @@ int hostfs_commit_write(struct file *file, struct page *page, unsigned from, long long start; int err = 0; - start = (long long) (page->index << PAGE_CACHE_SHIFT) + from; + start = (((long long) page->index) << PAGE_CACHE_SHIFT) + from; buffer = kmap(page); err = write_file(FILE_HOSTFS_I(file)->fd, &start, buffer + from, to - from); if(err > 0) err = 0; + + /* Actually, if !err, write_file has added to-from to start, so, despite + * the appearance, we are comparing i_size against the _last_ written + * location, as we should. */ + if(!err && (start > inode->i_size)) inode->i_size = start; -- cgit v1.2.3