Darrick J. Wong bd9ca962ee xfs: prevent creating negative-sized file via INSERT_RANGE ...

commit 7d83fb1425 upstream.

During the "insert range" fallocate operation, i_size grows by the
specified 'len' bytes.  XFS verifies that i_size + len < s_maxbytes, as
it should.  But this comparison is done using the signed 'loff_t', and
'i_size + len' can wrap around to a negative value, causing the check to
incorrectly pass, resulting in an inode with "negative" i_size.  This is
possible on 64-bit platforms, where XFS sets s_maxbytes = LLONG_MAX.
ext4 and f2fs don't run into this because they set a smaller s_maxbytes.

Fix it by using subtraction instead.

Reproducer:
    xfs_io -f file -c "truncate $(((1<<63)-1))" -c "finsert 0 4096"

Fixes: a904b1ca57 ("xfs: Add support FALLOC_FL_INSERT_RANGE for fallocate")
Cc: <stable@vger.kernel.org> # v4.1+
Originally-From: Eric Biggers <ebiggers@google.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
[darrick: fix signed integer addition overflow too]
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-05-09 09:51:52 +02:00

..

9p

fs/9p: Compare qid.path in v9fs_test_inode

2017-11-30 08:40:49 +00:00

adfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

affs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

afs

afs: Fix missing error handling in afs_write_end()

2018-03-03 10:24:32 +01:00

autofs4

autofs: mount point create should honour passed in mode

2018-04-24 09:36:39 +02:00

befs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

bfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

btrfs

Btrfs: raid56: fix race between merge_bio and rbio_orig_end_io

2018-04-26 11:02:09 +02:00

cachefiles

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ceph

ceph: only dirty ITER_IOVEC pages for direct read

2018-04-08 14:26:27 +02:00

cifs

cifs: silence compiler warnings showing up with gcc-8.0.0

2018-04-26 11:02:18 +02:00

coda

coda: fix 'kernel memory exposure attempt' in fsync

2017-11-24 08:37:05 +01:00

configfs

configfs: Introduce config_item_get_unless_zero()

2017-06-12 13:20:20 +02:00

cramfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

crypto

fscrypt: lock mutex before checking for bounce page pool

2017-11-30 08:40:44 +00:00

debugfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

devpts

devpts: fix error handling in devpts_mntget()

2018-02-16 20:23:11 +01:00

dlm

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ecryptfs

eCryptfs: use after free in ecryptfs_release_messaging()

2017-11-30 08:40:45 +00:00

efivarfs

VFS: Kill off s_options and helpers

2017-07-11 06:09:21 -04:00

efs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

exofs

Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block

2017-09-07 11:59:42 -07:00

exportfs

Merge branch 'rebased-statx' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-03-03 11:38:56 -08:00

ext2

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ext4

ext4: fix bitmap position validation

2018-05-01 12:58:07 -07:00

f2fs

f2fs: avoid hungtask when GC encrypted block if io_bits is set

2018-04-26 11:02:09 +02:00

fat

fs/fat/inode.c: fix sb_rdonly() change

2017-12-05 11:26:29 +01:00

freevxfs

freevxfs: update Kconfig information

2016-06-13 10:20:39 +02:00

fscache

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

fuse

fuse: fix READDIRPLUS skipping an entry

2017-10-25 16:34:27 +02:00

gfs2

GFS2: Take inode off order_write list when setting jdata flag

2017-12-20 10:10:29 +01:00

hfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

hfsplus

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

hostfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

hpfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

hugetlbfs

hugetlbfs: fix bug in pgoff overflow checking

2018-04-19 08:56:21 +02:00

isofs

isofs: fix timestamps beyond 2027

2017-11-30 08:40:45 +00:00

jbd2

ext4: set h_journal if there is a failure starting a reserved handle

2018-05-01 12:58:06 -07:00

jffs2

jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path

2018-04-26 11:02:12 +02:00

jfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

kernfs

kernfs: fix regression in kernfs_fop_write caused by wrong type

2018-02-16 20:22:59 +01:00

lockd

race of lockd inetaddr notifiers vs nlmsvc_rqst change

2018-02-03 17:39:08 +01:00

minix

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ncpfs

staging: ncpfs: memory corruption in ncp_read_kernel()

2018-03-28 18:24:43 +02:00

nfs

nfs: Do not convert nfs_idmap_cache_timeout to jiffies

2018-04-26 11:02:08 +02:00

nfs_common

lockd: fix "list_add double add" caused by legacy signal interface

2018-02-03 17:39:08 +01:00

nfsd

nfsd: fix incorrect umasks

2018-04-19 08:56:21 +02:00

nilfs2

nilfs2: fix race condition that causes file system corruption

2017-11-30 08:40:44 +00:00

nls

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

notify

fanotify: fix logic of events on child

2018-04-24 09:36:38 +02:00

ntfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ocfs2

ocfs2: return error when we attempt to access a dirty bh in jbd2

2018-04-26 11:02:14 +02:00

omfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

openpromfs

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

orangefs

orangefs_kill_sb(): deal with allocation failures

2018-04-24 09:36:38 +02:00

overlayfs

ovl: fix lookup with middle layer opaque dir and absolute path redirects

2018-04-19 08:56:21 +02:00

proc

vfs/proc/kcore, x86/mm/kcore: Fix SMAP fault when dumping vsyscall user page

2018-04-26 11:02:20 +02:00

pstore

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

qnx4

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

qnx6

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

quota

quota: Check for register_shrinker() failure.

2018-02-03 17:39:11 +01:00

ramfs

mm: make pagevec_lookup() update index

2017-09-06 17:27:26 -07:00

reiserfs

fs/reiserfs/journal.c: add missing resierfs_warning() arg

2018-04-24 09:36:22 +02:00

romfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

squashfs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

sysfs

sysfs: symlink: export sysfs_create_link_nowarn()

2018-03-31 18:10:38 +02:00

sysv

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

tracefs

VFS: Don't use save/replace_mount_options if not using generic_show_options

2017-07-06 03:31:46 -04:00

ubifs

ubifs: Fix uninitialized variable in search_dh_cookie()

2018-04-26 11:02:07 +02:00

udf

udf: Fix leak of UTF-16 surrogates into encoded strings

2018-04-24 09:36:38 +02:00

ufs

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xfs

xfs: prevent creating negative-sized file via INSERT_RANGE

2018-05-09 09:51:52 +02:00

aio.c

fs/aio: Use RCU accessors for kioctx_table->table[]

2018-03-21 12:06:43 +01:00

anon_inodes.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

attr.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

bad_inode.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

binfmt_aout.c

fs: fix kernel_read prototype

2017-09-04 19:05:15 -04:00

binfmt_elf_fdpic.c

Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:13:32 -07:00

binfmt_elf.c

Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:13:32 -07:00

binfmt_em86.c

fs/binfmt_em86.c: fix incompatible pointer type

2016-08-02 19:35:15 -04:00

binfmt_flat.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

binfmt_misc.c

fs/binfmt_misc.c: node could be NULL when evicting inode

2017-10-13 16:18:33 -07:00

binfmt_script.c

exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array

2017-10-03 17:54:25 -07:00

block_dev.c

fs/mpage.c: fix mpage_writepage() for pages with buffers

2017-10-13 16:18:33 -07:00

buffer.c

fs: guard_bio_eod() needs to consider partitions

2017-11-30 08:40:45 +00:00

char_dev.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

compat_binfmt_elf.c

fs/binfmt: Convert obsolete cputime type to nsecs

2017-02-01 09:13:51 +01:00

compat_ioctl.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

compat.c

fs/compat.c: trim unused includes

2017-04-17 12:52:27 -04:00

coredump.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

dax.c

fs/dax.c: release PMD lock even when there is no PMD support in DAX

2018-04-26 11:02:14 +02:00

dcache.c

VFS: close race between getcwd() and d_move()

2018-04-12 12:32:13 +02:00

dcookies.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

direct-io.c

direct-io: Fix sleep in atomic due to sync AIO

2018-03-08 22:41:06 -08:00

drop_caches.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

eventfd.c

Merge tag 'docs-4.13' of git://git.lwn.net/linux

2017-07-03 21:13:25 -07:00

eventpoll.c

fs/epoll: use faster rb_first_cached()

2017-09-08 18:26:49 -07:00

exec.c

exec: avoid gcc-8 warning for get_task_comm

2018-03-03 10:24:21 +01:00

fcntl.c

fcntl: don't cap l_start and l_end values for F_GETLK64 in compat syscall

2017-12-17 15:07:59 +01:00

fhandle.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

file_table.c

fput: Don't reinvent the wheel but use existing llist API

2017-08-28 00:50:23 -04:00

file.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

filesystems.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

fs_pin.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

fs_struct.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>

2017-03-02 08:42:35 +01:00

fs-writeback.c

writeback: safer lock nesting

2018-04-24 09:36:39 +02:00

inode.c

Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs

2017-09-13 09:11:44 -07:00

internal.h

Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs

2017-09-13 09:11:44 -07:00

ioctl.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

iomap.c

fs: invalidate page cache after end_io() in dio completion

2017-10-16 12:11:56 -07:00

Kconfig

fs/Kconfig: kill CONFIG_PERCPU_RWSEM some more

2017-07-12 16:26:00 -07:00

Kconfig.binfmt

docs: fix locations of several documents that got moved

2016-10-24 08:12:35 -02:00

libfs.c

fs: convert __generic_file_fsync to use errseq_t based reporting

2017-07-06 07:02:29 -04:00

locks.c

locks: restore a warn for leaked locks on close

2017-07-21 13:57:31 -04:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mbcache.c

mbcache: initialize entry->e_referenced in mb_cache_entry_create()

2018-02-22 15:42:25 +01:00

mount.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mpage.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

namei.c

getname_kernel() needs to make sure that ->name != ->iname in long case

2018-04-19 08:56:19 +02:00

namespace.c

Don't leak MNT_INTERNAL away from internal mounts

2018-04-24 09:36:39 +02:00

no-block.c

…

nsfs.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

open.c

ovl: don't allow writing ioctl on lower layer

2017-09-05 12:53:12 +02:00

pipe.c

pipe: fix off-by-one error when checking buffer limits

2018-02-16 20:23:05 +01:00

pnode.c

mnt: Make propagate_umount less slow for overlapping mount propagation trees

2017-05-23 08:41:17 -05:00

pnode.h

mnt: Tuck mounts under others instead of creating shadow/side mounts.

2017-02-04 00:01:06 +13:00

posix_acl.c

sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>

2017-03-02 08:42:31 +01:00

proc_namespace.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

read_write.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

readdir.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

select.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

seq_file.c

seq_file: fix incomplete reset on read from zero offset

2018-02-22 15:42:28 +01:00

signalfd.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

splice.c

fs: move kernel_write to fs/read_write.c

2017-09-04 19:05:15 -04:00

stack.c

…

stat.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

statfs.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

super.c

sget(): handle failures of register_shrinker()

2018-03-03 10:24:24 +01:00

sync.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

timerfd.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

userfaultfd.c

userfaultfd: clear the vma->vm_userfaultfd_ctx if UFFD_EVENT_FORK fails

2018-01-10 09:31:17 +01:00

utimes.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xattr.c

lsm: fix smack_inode_removexattr and xattr_getsecurity memleak

2017-10-04 18:03:15 +11:00