vfs: Fix implicit conversion problem when testing overflow case
The overflow check in generic_copy_file_checks() and generic_remap_checks() is now broken because the result of the addition is implicitly converted to an unsigned type, which disrupts the comparison with signed numbers. This caused the kernel to not return EOVERFLOW in copy_file_range() call with len is set to 0xffffffffa003e45bul. Use the check_add_overflow() macro to fix this issue. Reported-and-tested-by:<syzbot+296b1c84b9cbf306e5a0@syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=296b1c84b9cbf306e5a0 Fixes: 1383a7ed ("vfs: check file ranges before cloning files") Fixes: 96e6e8f4 ("vfs: add missing checks to copy_file_range") Inspired-by:
Dave Chinner <david@fromorbit.com> Reviewed-by:
Jan Kara <jack@suse.cz> Signed-off-by:
Julian Sun <sunjunchao2870@gmail.com> Link: https://lore.kernel.org/stable/20240920122851.215641-1-sunjunchao2870%40gmail.com Link: https://lore.kernel.org/r/20240920122851.215641-1-sunjunchao2870@gmail.com Reviewed-by:
Christoph Hellwig <hch@lst.de> Reviewed-by:
Darrick J. Wong <djwong@kernel.org> Rule: add Signed-off-by:
Christian Brauner <brauner@kernel.org>
Loading
Please register or sign in to comment