Commit 5d510ac3 authored by Qianchang Zhao's avatar Qianchang Zhao Committed by Steve French
Browse files

ksmbd: skip lock-range check on equal size to avoid size==0 underflow 



When size equals the current i_size (including 0), the code used to call
check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1`
and can underflow for size==0. Skip the equal case.

Cc: stable@vger.kernel.org
Reported-by: default avatarQianchang Zhao <pioooooooooip@gmail.com>
Reported-by: default avatarZhitong Liu <liuzhitong1993@gmail.com>
Signed-off-by: default avatarQianchang Zhao <pioooooooooip@gmail.com>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 9c98f5ee

fs/smb/server/vfs.c

+4 −1
Original line number Diff line number Diff line
@@ -324,6 +324,9 @@ static int check_lock_range(struct file *filp, loff_t start, loff_t end, 
	struct file_lock_context *ctx = locks_inode_context(file_inode(filp));

	int error = 0;



	if (start == end)

		return 0;



	if (!ctx || list_empty_careful(&ctx->flc_posix))

		return 0;
@@ -828,7 +831,7 @@ int ksmbd_vfs_truncate(struct ksmbd_work *work, 
		if (size < inode->i_size) {

			err = check_lock_range(filp, size,

					       inode->i_size - 1, WRITE);

		} else {

		} else if (size > inode->i_size) {

			err = check_lock_range(filp, inode->i_size,

					       size - 1, WRITE);

		}