diff options
| author | Trond Myklebust <trond.myklebust@hammerspace.com> | 2024-09-13 13:57:04 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-11-14 13:19:39 +0100 |
| commit | a2746ab3bbc9c6408da5cd072653ec8c24749235 (patch) | |
| tree | fab1def337f1edc6abe98360e4028c6f74bb67df /mm | |
| parent | 575a562f7a3ec2d54ff77ab6810e3fbceef2a91d (diff) | |
| download | linux-a2746ab3bbc9c6408da5cd072653ec8c24749235.tar.gz linux-a2746ab3bbc9c6408da5cd072653ec8c24749235.tar.bz2 linux-a2746ab3bbc9c6408da5cd072653ec8c24749235.zip | |
filemap: Fix bounds checking in filemap_read()
commit ace149e0830c380ddfce7e466fe860ca502fe4ee upstream.
If the caller supplies an iocb->ki_pos value that is close to the
filesystem upper limit, and an iterator with a count that causes us to
overflow that limit, then filemap_read() enters an infinite loop.
This behaviour was discovered when testing xfstests generic/525 with the
"localio" optimisation for loopback NFS mounts.
Reported-by: Mike Snitzer <snitzer@kernel.org>
Fixes: c2a9737f45e2 ("vfs,mm: fix a dead loop in truncate_inode_pages_range()")
Tested-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'mm')
| -rw-r--r-- | mm/filemap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/mm/filemap.c b/mm/filemap.c index e6c112f3a211..5e9359e4ff9e 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -2660,7 +2660,7 @@ ssize_t filemap_read(struct kiocb *iocb, struct iov_iter *iter, if (unlikely(!iov_iter_count(iter))) return 0; - iov_iter_truncate(iter, inode->i_sb->s_maxbytes); + iov_iter_truncate(iter, inode->i_sb->s_maxbytes - iocb->ki_pos); folio_batch_init(&fbatch); do { |