Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tmpfs: Refuse sizes that overflow round_page. 

Reported-by: syzbot+8dbeee84de15f86df65b@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=4a27b9fe074f8d4b0afbe22969339b8dfdb157e8
This commit is contained in:
riastradh 2023-04-29 08:13:27 +00:00
parent 769a293eed
commit 08655e8aab
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/fs/tmpfs/tmpfs_subr.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: tmpfs_subr.c,v 1.115 2023/04/29 06:29:55 riastradh Exp $ */ /* $NetBSD: tmpfs_subr.c,v 1.116 2023/04/29 08:13:27 riastradh Exp $ */
/* /*
* Copyright (c) 2005-2020 The NetBSD Foundation, Inc. * Copyright (c) 2005-2020 The NetBSD Foundation, Inc.
@ -73,7 +73,7 @@
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.115 2023/04/29 06:29:55 riastradh Exp $"); __KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.116 2023/04/29 08:13:27 riastradh Exp $");
#include <sys/param.h> #include <sys/param.h>
#include <sys/cprng.h> #include <sys/cprng.h>
@ -907,6 +907,9 @@ tmpfs_reg_resize(struct vnode *vp, off_t newsize)
KASSERT(vp->v_type == VREG); KASSERT(vp->v_type == VREG);
KASSERT(newsize >= 0); KASSERT(newsize >= 0);
if (newsize > __type_max(off_t) - PAGE_SIZE + 1)
return EFBIG;
oldsize = node->tn_size; oldsize = node->tn_size;
oldpages = round_page(oldsize) >> PAGE_SHIFT; oldpages = round_page(oldsize) >> PAGE_SHIFT;
newpages = round_page(newsize) >> PAGE_SHIFT; newpages = round_page(newsize) >> PAGE_SHIFT;