From: Ahmad Fatoum <[email protected]>
ubootvarfs_truncate() stores the size difference in an int and checks
the room left by forming a pointer that far past the end of the
environment. A size 4 GiB past the current one wraps to a difference of
zero, the truncate succeeds and the VFS records a 4 GiB file size. As
ubootvarfs_io() relies on the VFS to clamp reads and writes to that
size, md and mw on the variable then go well past the environment
buffer. A size 2 GiB past the current one wraps to a large negative
difference and the tail is moved 2 GiB below the buffer.
Let's keep the difference in a loff_t, compare it against the room left
instead of forming the pointer and reject negative sizes, which the
driver cannot handle either. The resize helpers take a ptrdiff_t now,
so the checked difference reaches them unchanged.
Fixes: 8daaa21b3949 ("fs: Add a driver to access U-Boot environment variables")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <[email protected]>
---
fs/ubootvarfs.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/fs/ubootvarfs.c b/fs/ubootvarfs.c
index a703f16a10f3..3b5c3039e3aa 100644
--- a/fs/ubootvarfs.c
+++ b/fs/ubootvarfs.c
@@ -197,7 +197,7 @@ static const struct file_operations
ubootvarfs_dir_operations = {
* zeroed out
*/
static void ubootvarfs_relocate_tail(struct ubootvarfs_inode *node,
- int delta)
+ ptrdiff_t delta)
{
struct ubootvarfs_var *var = node->var;
struct ubootvarfs_data *data = node->data;
@@ -235,7 +235,7 @@ static void ubootvarfs_relocate_tail(struct
ubootvarfs_inode *node,
* ubootvarfs_var's in varaible linked list
*/
static void ubootvarfs_adjust(struct ubootvarfs_inode *node,
- int delta)
+ ptrdiff_t delta)
{
struct ubootvarfs_var *var = node->var;
struct ubootvarfs_data *data = node->data;
@@ -260,7 +260,7 @@ static int ubootvarfs_unlink(struct inode *dir, struct
dentry *dentry)
* -1 at the end is to account for '\0' at the end
* that needs to be removed as well
*/
- const int delta = var->name - var->end - 1;
+ const ptrdiff_t delta = var->name - var->end - 1;
ubootvarfs_adjust(node, delta);
@@ -369,12 +369,16 @@ static int ubootvarfs_truncate(struct file *f, loff_t
size)
struct ubootvarfs_inode *node = inode_to_node(inode);
struct ubootvarfs_data *data = node->data;
struct ubootvarfs_var *var = node->var;
- const int delta = size - inode->i_size;
+ loff_t delta;
+
+ if (size < 0)
+ return -EINVAL;
if (size == inode->i_size)
return 0;
- if (data->end + delta >= data->limit)
+ delta = size - inode->i_size;
+ if (delta >= data->limit - data->end)
return -ENOSPC;
ubootvarfs_adjust(node, delta);
--
2.47.3
