Re: [PATCH] udf: Fix i_lenExtents truncation on 32-bit kernels

[Jan Kara]

On Wed 22-07-26 16:24:25, Zhan Xusheng wrote:
> In udf_do_extend_file() the total extent length is rounded up to a block
> boundary with:
> 
> 	iinfo->i_lenExtents = (iinfo->i_lenExtents + sb->s_blocksize - 1) &
> 			      ~(sb->s_blocksize - 1);
> 
> i_lenExtents is a __u64, but sb->s_blocksize is unsigned long.  On 32-bit
> kernels unsigned long is 32-bit, so ~(sb->s_blocksize - 1) is a 32-bit
> value (e.g. 0xfffff800 for a 2 KiB block) that is zero-extended in the AND,
> clearing the upper 32 bits of i_lenExtents.  For UDF files whose total
> extent length exceeds 4 GiB this truncates i_lenExtents when the file is
> extended, corrupting the tracked extent length.
> 
> Cast the block size to 64-bit before forming the mask.  64-bit kernels are
> unaffected.
> 
> Fixes: 48d6d8ff7dca ("udf: cache struct udf_inode_info")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>

Thanks. I've added the patch to my tree.

								Honza

> ---
>  fs/udf/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/udf/inode.c b/fs/udf/inode.c
> index 67bcf83758c8..c519644acfd7 100644
> --- a/fs/udf/inode.c
> +++ b/fs/udf/inode.c
> @@ -531,7 +531,7 @@ static int udf_do_extend_file(struct inode *inode,
>  			  sb->s_blocksize - 1) & ~(sb->s_blocksize - 1));
>  		iinfo->i_lenExtents =
>  			(iinfo->i_lenExtents + sb->s_blocksize - 1) &
> -			~(sb->s_blocksize - 1);
> +			~((u64)sb->s_blocksize - 1);
>  	}
>  
>  	add = 0;
> -- 
> 2.43.0
> 
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR