diff options
| author | Chao Yu <yuchao0@huawei.com> | 2018-04-25 19:38:17 +0800 |
|---|---|---|
| committer | Jaegeuk Kim <jaegeuk@kernel.org> | 2018-05-31 11:31:49 -0700 |
| commit | a9af3fdcc4258af406879eca63d82e9d6baa892e (patch) | |
| tree | 34a64f714cb55337dfdce76655d58a26e0f26534 /fs/f2fs | |
| parent | b2532c694033fb6762478846c457382061f9f630 (diff) | |
| download | linux-a9af3fdcc4258af406879eca63d82e9d6baa892e.tar.gz linux-a9af3fdcc4258af406879eca63d82e9d6baa892e.tar.bz2 linux-a9af3fdcc4258af406879eca63d82e9d6baa892e.zip | |
f2fs: fix potential overflow
In build_sit_entries(), if valid_blocks in SIT block is smaller than
valid_blocks in journal, for below calculation:
sbi->discard_blks += old_valid_blocks - se->valid_blocks;
There will be two times potential overflow:
- old_valid_blocks - se->valid_blocks will overflow, and be a very
large number.
- sbi->discard_blks += result will overflow again, comes out a correct
result accidently.
Anyway, it should be fixed.
Fixes: d600af236da5 ("f2fs: avoid unneeded loop in build_sit_entries")
Fixes: 1f43e2ad7bff ("f2fs: introduce CP_TRIMMED_FLAG to avoid unneeded discard")
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Diffstat (limited to 'fs/f2fs')
| -rw-r--r-- | fs/f2fs/segment.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index 1576b9d9a172..fec698d17d6a 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -3714,14 +3714,17 @@ static int build_sit_entries(struct f2fs_sb_info *sbi) } else { memcpy(se->discard_map, se->cur_valid_map, SIT_VBLOCK_MAP_SIZE); - sbi->discard_blks += old_valid_blocks - - se->valid_blocks; + sbi->discard_blks += old_valid_blocks; + sbi->discard_blks -= se->valid_blocks; } } - if (sbi->segs_per_sec > 1) + if (sbi->segs_per_sec > 1) { get_sec_entry(sbi, start)->valid_blocks += - se->valid_blocks - old_valid_blocks; + se->valid_blocks; + get_sec_entry(sbi, start)->valid_blocks -= + old_valid_blocks; + } } up_read(&curseg->journal_rwsem); |