Blob Blame History Raw
From a4ac9d45c0cd14a2adc872186431c79804b77dbf Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Mon Feb  3 11:41:53 2020 +0100
Subject: [PATCH] ovl: fix lseek overflow on 32bit
Git-commit: a4ac9d45c0cd14a2adc872186431c79804b77dbf
References: git-fixes
Patch-mainline: v5.6-rc1

ovl_lseek() is using ssize_t to return the value from vfs_llseek().  On a
32-bit kernel ssize_t is a 32-bit signed int, which overflows above 2 GB.

Assign the return value of vfs_llseek() to loff_t to fix this.

Reported-by: Boris Gjenero <boris.gjenero@gmail.com>
Fixes: 9e46b840c705 ("ovl: support stacked SEEK_HOLE/SEEK_DATA")
Cc: <stable@vger.kernel.org> # v4.19
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Acked-by: Goldwyn Rodrigues <rgoldwyn@suse.com>

diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index 67ef4c8..a531721 100644

--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -157,7 +157,7 @@ static loff_t ovl_llseek(struct file *file, loff_t offset, int whence)
 	struct inode *inode = file_inode(file);
 	struct fd real;
 	const struct cred *old_cred;
-	ssize_t ret;
+	loff_t ret;
 
 	/*
 	 * The two special cases below do not need to involve real fs,