ChangeSet 1.2040.3.9, 2005/02/03 10:18:57-08:00, torvalds <at> ppc970.osdl.org

	Make generic rw_verify_area check against file offset overflows.
	
	Not that low-level code really tends to care, but since loff_t is
	a signed 64-bit entity and size_t is unsigned (and potentially
	64-bit), mixing the two isn't very well-defined.. 

 read_write.c |   13 ++++++++++---
 1 files changed, 10 insertions(+), 3 deletions(-)

diff -Nru a/fs/read_write.c b/fs/read_write.c
--- a/fs/read_write.c	2005-02-03 11:12:33 -08:00
+++ b/fs/read_write.c	2005-02-03 11:12:33 -08:00
@@ -186,14 +186,21 @@
 int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count)
 {
 	struct inode *inode;
+	loff_t pos;

-	if (count > file->f_maxcount)
-		return -EINVAL;
+	if (unlikely(count > file->f_maxcount))
+		goto Einval;
+	pos = *ppos;
+	if (unlikely((pos < 0) || (loff_t) (pos + count) < 0))
+		goto Einval;

 	inode = file->f_dentry->d_inode;
 	if (inode->i_flock && MANDATORY_LOCK(inode))
-		return locks_mandatory_area(read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE, inode,
file, *ppos, count);
+		return locks_mandatory_area(read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE, inode,
file, pos, count);
 	return 0;
+
+Einval:
+	return -EINVAL;
 }

 ssize_t do_sync_read(struct file *filp, char __user *buf, size_t len, loff_t *ppos)