diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2021-09-28 07:53:53 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2021-09-28 07:53:53 -0700 |
| commit | 6fd3ec5c7af58d5d6b598fba22ac387645af33f4 (patch) | |
| tree | 4abf071761f93a87b1527837503ef9d10b10ea56 /fs | |
| parent | d33bec7b3dfa36691ed53ccaaf187d90b53be852 (diff) | |
| parent | 80f6e3080bfcf865062a926817b3ca6c4a137a57 (diff) | |
| download | linux-6fd3ec5c7af58d5d6b598fba22ac387645af33f4.tar.bz2 | |
Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt
Pull fsverity fix from Eric Biggers:
"Fix an integer overflow when computing the Merkle tree layout of
extremely large files, exposed by btrfs adding support for fs-verity"
* tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt:
fs-verity: fix signed integer overflow with i_size near S64_MAX
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/verity/enable.c | 2 | ||||
| -rw-r--r-- | fs/verity/open.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/fs/verity/enable.c b/fs/verity/enable.c index 77e159a0346b..60a4372aa4d7 100644 --- a/fs/verity/enable.c +++ b/fs/verity/enable.c @@ -177,7 +177,7 @@ static int build_merkle_tree(struct file *filp, * (level 0) and ascending to the root node (level 'num_levels - 1'). * Then at the end (level 'num_levels'), calculate the root hash. */ - blocks = (inode->i_size + params->block_size - 1) >> + blocks = ((u64)inode->i_size + params->block_size - 1) >> params->log_blocksize; for (level = 0; level <= params->num_levels; level++) { err = build_merkle_tree_level(filp, level, blocks, params, diff --git a/fs/verity/open.c b/fs/verity/open.c index 60ff8af7219f..92df87f5fa38 100644 --- a/fs/verity/open.c +++ b/fs/verity/open.c @@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params, */ /* Compute number of levels and the number of blocks in each level */ - blocks = (inode->i_size + params->block_size - 1) >> log_blocksize; + blocks = ((u64)inode->i_size + params->block_size - 1) >> log_blocksize; pr_debug("Data is %lld bytes (%llu blocks)\n", inode->i_size, blocks); while (blocks > 1) { if (params->num_levels >= FS_VERITY_MAX_LEVELS) { |