Skip to content

Commit 5d510ac

Browse files
llllIIIllllsmfrench
authored andcommitted
ksmbd: skip lock-range check on equal size to avoid size==0 underflow
When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1` and can underflow for size==0. Skip the equal case. Cc: stable@vger.kernel.org Reported-by: Qianchang Zhao <pioooooooooip@gmail.com> Reported-by: Zhitong Liu <liuzhitong1993@gmail.com> Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
1 parent 9c98f5e commit 5d510ac

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

fs/smb/server/vfs.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -324,6 +324,9 @@ static int check_lock_range(struct file *filp, loff_t start, loff_t end,
324324
struct file_lock_context *ctx = locks_inode_context(file_inode(filp));
325325
int error = 0;
326326

327+
if (start == end)
328+
return 0;
329+
327330
if (!ctx || list_empty_careful(&ctx->flc_posix))
328331
return 0;
329332

@@ -828,7 +831,7 @@ int ksmbd_vfs_truncate(struct ksmbd_work *work,
828831
if (size < inode->i_size) {
829832
err = check_lock_range(filp, size,
830833
inode->i_size - 1, WRITE);
831-
} else {
834+
} else if (size > inode->i_size) {
832835
err = check_lock_range(filp, inode->i_size,
833836
size - 1, WRITE);
834837
}

0 commit comments

Comments
 (0)