mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 06:41:39 -04:00
Code Issues Packages Projects Releases Wiki Activity

xfs: fix integer overflow in deferred intent sort comparators

Browse Source 
xfs_extent_free_diff_items(), xfs_refcount_update_diff_items(), and
xfs_rmap_update_diff_items() subtract two uint32_t group numbers
and return the result as int, which can overflow when the difference
exceeds INT_MAX.

Use cmp_int() instead, as was done in commit 362c490980 ("xfs:
fix integer overflow in bmap intent sort comparator").

Fixes: c13418e8eb ("xfs: give xfs_rmap_intent its own perag reference")
Fixes: f6b384631e ("xfs: give xfs_extfree_intent its own perag reference")
Fixes: 00e7b3bac1 ("xfs: give xfs_refcount_intent its own perag reference")
Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
This commit is contained in:
Yuto Ohnuki
2026-03-28 17:34:09 +00:00
committed by Carlos Maiolino
parent e92b3fc5b1
commit 59e586d7dc
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
fs/xfs/xfs_extfree_item.c
View File

@@ -387,7 +387,7 @@ xfs_extent_free_diff_items(
struct xfs_extent_free_item *ra = xefi_entry(a);
struct xfs_extent_free_item *rb = xefi_entry(b);
return ra->xefi_group->xg_gno - rb->xefi_group->xg_gno;
return cmp_int(ra->xefi_group->xg_gno, rb->xefi_group->xg_gno);
}
/* Log a free extent to the intent item. */

2
fs/xfs/xfs_refcount_item.c
View File

@@ -266,7 +266,7 @@ xfs_refcount_update_diff_items(
struct xfs_refcount_intent *ra = ci_entry(a);
struct xfs_refcount_intent *rb = ci_entry(b);
return ra->ri_group->xg_gno - rb->ri_group->xg_gno;
return cmp_int(ra->ri_group->xg_gno, rb->ri_group->xg_gno);
}
/* Log refcount updates in the intent item. */

2
fs/xfs/xfs_rmap_item.c
View File

@@ -267,7 +267,7 @@ xfs_rmap_update_diff_items(
struct xfs_rmap_intent *ra = ri_entry(a);
struct xfs_rmap_intent *rb = ri_entry(b);
return ra->ri_group->xg_gno - rb->ri_group->xg_gno;
return cmp_int(ra->ri_group->xg_gno, rb->ri_group->xg_gno);
}
/* Log rmap updates in the intent item. */