releases/2.6.14.4/32bit-integer-overflow-in-invalidate_inode_pages2.patch

   1 From stable-bounces@linux.kernel.org Fri Dec  2 13:00:27 2005
   2 Message-ID: <4390B550.4080900@gentoo.org>
   3 Date: Fri, 02 Dec 2005 20:57:52 +0000
   4 From: Daniel Drake <dsd@gentoo.org>
   5 To: stable@kernel.org
   6 Cc: green@linuxhacker.ru
   7 Subject: 32bit integer overflow in invalidate_inode_pages2()
   8 X-Git-Tag: v2.6.15-rc3
   9 X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=479ef592f3664dd629417098c8599261c0f689ab
  10
  11 From: Oleg Drokin <green@linuxhacker.ru>
  12
  13 [PATCH] 32bit integer overflow in invalidate_inode_pages2()
  14
  15 Fix a 32 bit integer overflow in invalidate_inode_pages2_range.
  16
  17 Signed-off-by: Andrew Morton <akpm@osdl.org>
  18 Signed-off-by: Linus Torvalds <torvalds@osdl.org>
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  20 ---
  21  mm/truncate.c |    6 +++---
  22  1 file changed, 3 insertions(+), 3 deletions(-)
  23
  24 --- linux-2.6.14.3.orig/mm/truncate.c
  25 +++ linux-2.6.14.3/mm/truncate.c
  26 @@ -291,8 +291,8 @@ int invalidate_inode_pages2_range(struct
  27                                          * Zap the rest of the file in one hit.
  28                                          */
  29                                         unmap_mapping_range(mapping,
  30 -                                           page_index << PAGE_CACHE_SHIFT,
  31 -                                           (end - page_index + 1)
  32 +                                          (loff_t)page_index<<PAGE_CACHE_SHIFT,
  33 +                                          (loff_t)(end - page_index + 1)
  34                                                         << PAGE_CACHE_SHIFT,
  35                                             0);
  36                                         did_range_unmap = 1;
  37 @@ -301,7 +301,7 @@ int invalidate_inode_pages2_range(struct
  38                                          * Just zap this page
  39                                          */
  40                                         unmap_mapping_range(mapping,
  41 -                                         page_index << PAGE_CACHE_SHIFT,
  42 +                                         (loff_t)page_index<<PAGE_CACHE_SHIFT,
  43                                           PAGE_CACHE_SIZE, 0);
  44                                 }
  45                         }