Skip to content

Commit 553a13e

Browse files
Yuto Ohnukicmaiolino
authored andcommitted
xfs: fix integer overflow in busy extent sort comparator
xfs_extent_busy_ag_cmp() subtracts two uint32_t values (group numbers and block numbers) and returns the result as s32. When the difference exceeds INT_MAX, the result overflows and the sort order is corrupted. Use cmp_int() instead, as was done in commit 362c490 ("xfs: fix integer overflow in bmap intent sort comparator"). Fixes: 4a137e0 ("xfs: keep a reference to the pag for busy extents") Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Signed-off-by: Carlos Maiolino <cem@kernel.org>
1 parent 59e586d commit 553a13e

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

fs/xfs/xfs_extent_busy.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -690,9 +690,9 @@ xfs_extent_busy_ag_cmp(
690690
container_of(l2, struct xfs_extent_busy, list);
691691
s32 diff;
692692

693-
diff = b1->group->xg_gno - b2->group->xg_gno;
693+
diff = cmp_int(b1->group->xg_gno, b2->group->xg_gno);
694694
if (!diff)
695-
diff = b1->bno - b2->bno;
695+
diff = cmp_int(b1->bno, b2->bno);
696696
return diff;
697697
}
698698

0 commit comments

Comments
 (0)