releases/4.5.7/btrfs-fix-int32-overflow-in-shrink_delalloc.patch

   1 From 8eb0dfdbda3f56bf7d248ed87fcc383df114ecbb Mon Sep 17 00:00:00 2001
   2 From: Adam Borowski <kilobyte@angband.pl>
   3 Date: Sun, 8 May 2016 15:08:00 +0200
   4 Subject: btrfs: fix int32 overflow in shrink_delalloc().
   5
   6 From: Adam Borowski <kilobyte@angband.pl>
   7
   8 commit 8eb0dfdbda3f56bf7d248ed87fcc383df114ecbb upstream.
   9
  10 UBSAN: Undefined behaviour in fs/btrfs/extent-tree.c:4623:21
  11 signed integer overflow:
  12 10808 * 262144 cannot be represented in type 'int [8]'
  13
  14 If 8192<=items<16384, we request a writeback of an insane number of pages
  15 which is benign (everything will be written).  But if items>=16384, the
  16 space reservation won't be enough.
  17
  18 Signed-off-by: Adam Borowski <kilobyte@angband.pl>
  19 Reviewed-by: David Sterba <dsterba@suse.com>
  20 Signed-off-by: David Sterba <dsterba@suse.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22
  23 ---
  24  fs/btrfs/extent-tree.c |    2 +-
  25  1 file changed, 1 insertion(+), 1 deletion(-)
  26
  27 --- a/fs/btrfs/extent-tree.c
  28 +++ b/fs/btrfs/extent-tree.c
  29 @@ -4620,7 +4620,7 @@ static void shrink_delalloc(struct btrfs
  30
  31         /* Calc the number of the pages we need flush for space reservation */
  32         items = calc_reclaim_items_nr(root, to_reclaim);
  33 -       to_reclaim = items * EXTENT_SIZE_PER_ITEM;
  34 +       to_reclaim = (u64)items * EXTENT_SIZE_PER_ITEM;
  35
  36         trans = (struct btrfs_trans_handle *)current->journal_info;
  37         block_rsv = &root->fs_info->delalloc_block_rsv;