Skip to content

Commit 59e586d

Browse files
Yuto Ohnukicmaiolino
authored andcommitted
xfs: fix integer overflow in deferred intent sort comparators
xfs_extent_free_diff_items(), xfs_refcount_update_diff_items(), and xfs_rmap_update_diff_items() subtract two uint32_t group numbers and return the result as int, which can overflow when the difference exceeds INT_MAX. Use cmp_int() instead, as was done in commit 362c490 ("xfs: fix integer overflow in bmap intent sort comparator"). Fixes: c13418e ("xfs: give xfs_rmap_intent its own perag reference") Fixes: f6b3846 ("xfs: give xfs_extfree_intent its own perag reference") Fixes: 00e7b3b ("xfs: give xfs_refcount_intent its own perag reference") Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Signed-off-by: Carlos Maiolino <cem@kernel.org>
1 parent e92b3fc commit 59e586d

3 files changed

Lines changed: 3 additions & 3 deletions

File tree

fs/xfs/xfs_extfree_item.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -387,7 +387,7 @@ xfs_extent_free_diff_items(
387387
struct xfs_extent_free_item *ra = xefi_entry(a);
388388
struct xfs_extent_free_item *rb = xefi_entry(b);
389389

390-
return ra->xefi_group->xg_gno - rb->xefi_group->xg_gno;
390+
return cmp_int(ra->xefi_group->xg_gno, rb->xefi_group->xg_gno);
391391
}
392392

393393
/* Log a free extent to the intent item. */

fs/xfs/xfs_refcount_item.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -266,7 +266,7 @@ xfs_refcount_update_diff_items(
266266
struct xfs_refcount_intent *ra = ci_entry(a);
267267
struct xfs_refcount_intent *rb = ci_entry(b);
268268

269-
return ra->ri_group->xg_gno - rb->ri_group->xg_gno;
269+
return cmp_int(ra->ri_group->xg_gno, rb->ri_group->xg_gno);
270270
}
271271

272272
/* Log refcount updates in the intent item. */

fs/xfs/xfs_rmap_item.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,7 @@ xfs_rmap_update_diff_items(
267267
struct xfs_rmap_intent *ra = ri_entry(a);
268268
struct xfs_rmap_intent *rb = ri_entry(b);
269269

270-
return ra->ri_group->xg_gno - rb->ri_group->xg_gno;
270+
return cmp_int(ra->ri_group->xg_gno, rb->ri_group->xg_gno);
271271
}
272272

273273
/* Log rmap updates in the intent item. */

0 commit comments

Comments
 (0)