]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
filemap: Fix bounds checking in filemap_read()
authorTrond Myklebust <trond.myklebust@hammerspace.com>
Mon, 14 Apr 2025 18:50:22 +0000 (11:50 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 2 May 2025 05:44:18 +0000 (07:44 +0200)
commit6cc52df69e8464811f9f6fc12f7aaa78451eb0b8
tree8061becc79da756f418120287f08a5dcda793578
parent90c8482a5d9791259ba77bfdc1849fc5128b4be7
filemap: Fix bounds checking in filemap_read()

[ Upstream commit ace149e0830c380ddfce7e466fe860ca502fe4ee ]

If the caller supplies an iocb->ki_pos value that is close to the
filesystem upper limit, and an iterator with a count that causes us to
overflow that limit, then filemap_read() enters an infinite loop.

This behaviour was discovered when testing xfstests generic/525 with the
"localio" optimisation for loopback NFS mounts.

Reported-by: Mike Snitzer <snitzer@kernel.org>
Fixes: c2a9737f45e2 ("vfs,mm: fix a dead loop in truncate_inode_pages_range()")
Tested-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit ace149e0830c380ddfce7e466fe860ca502fe4ee)
[Harshit: Minor conflict resolved due to missing commit: 25d6a23e8d28
("filemap: Convert filemap_get_read_batch() to use a folio_batch") in
5.15.y]
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mm/filemap.c