[PATCH] uml: hostfs - fix possible PAGE_CACHE_SHIFT overflows
authorPaolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Thu, 29 Dec 2005 16:39:57 +0000 (17:39 +0100)
committerLinus Torvalds <torvalds@g5.osdl.org>
Thu, 29 Dec 2005 17:48:15 +0000 (09:48 -0800)
Prevent page->index << PAGE_CACHE_SHIFT from overflowing.

There is a casting there, but was added without care, so it's at the wrong
place. Note the extra parens around the shift - "+" is higher precedence than
"<<", leading to a GCC warning which saved all us.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
fs/hostfs/hostfs_kern.c

index 3aac164c7726f2cb7586b2b4d732765a3517b07a..b3ad0bd0312f2ecc7e9ab8ea2dc37639a3a7b0d0 100644 (file)
@@ -501,11 +501,16 @@ int hostfs_commit_write(struct file *file, struct page *page, unsigned from,
        long long start;
        int err = 0;
 
-       start = (long long) (page->index << PAGE_CACHE_SHIFT) + from;
+       start = (((long long) page->index) << PAGE_CACHE_SHIFT) + from;
        buffer = kmap(page);
        err = write_file(FILE_HOSTFS_I(file)->fd, &start, buffer + from,
                         to - from);
        if(err > 0) err = 0;
+
+       /* Actually, if !err, write_file has added to-from to start, so, despite
+        * the appearance, we are comparing i_size against the _last_ written
+        * location, as we should. */
+
        if(!err && (start > inode->i_size))
                inode->i_size = start;