diff options
| author | Yuto Ohnuki <ytohnuki@amazon.com> | 2026-03-28 20:34:09 +0300 |
|---|---|---|
| committer | Carlos Maiolino <cem@kernel.org> | 2026-04-07 14:08:27 +0300 |
| commit | 59e586d7dc7813910abe20a8281bbc3f1360e08e (patch) | |
| tree | d822ab4444f59a2cec09d326d9123069ba833f7b | |
| parent | e92b3fc5b17c75d3ca31983a7d35e8b88786ee4e (diff) | |
| download | linux-59e586d7dc7813910abe20a8281bbc3f1360e08e.tar.xz | |
xfs: fix integer overflow in deferred intent sort comparators
xfs_extent_free_diff_items(), xfs_refcount_update_diff_items(), and
xfs_rmap_update_diff_items() subtract two uint32_t group numbers
and return the result as int, which can overflow when the difference
exceeds INT_MAX.
Use cmp_int() instead, as was done in commit 362c49098086 ("xfs:
fix integer overflow in bmap intent sort comparator").
Fixes: c13418e8eb37 ("xfs: give xfs_rmap_intent its own perag reference")
Fixes: f6b384631e1e ("xfs: give xfs_extfree_intent its own perag reference")
Fixes: 00e7b3bac1dc ("xfs: give xfs_refcount_intent its own perag reference")
Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
| -rw-r--r-- | fs/xfs/xfs_extfree_item.c | 2 | ||||
| -rw-r--r-- | fs/xfs/xfs_refcount_item.c | 2 | ||||
| -rw-r--r-- | fs/xfs/xfs_rmap_item.c | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c index 749a4eb9793c..2266d56e37dc 100644 --- a/fs/xfs/xfs_extfree_item.c +++ b/fs/xfs/xfs_extfree_item.c @@ -387,7 +387,7 @@ xfs_extent_free_diff_items( struct xfs_extent_free_item *ra = xefi_entry(a); struct xfs_extent_free_item *rb = xefi_entry(b); - return ra->xefi_group->xg_gno - rb->xefi_group->xg_gno; + return cmp_int(ra->xefi_group->xg_gno, rb->xefi_group->xg_gno); } /* Log a free extent to the intent item. */ diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c index 881c3f3a6a24..8bccf89a7766 100644 --- a/fs/xfs/xfs_refcount_item.c +++ b/fs/xfs/xfs_refcount_item.c @@ -266,7 +266,7 @@ xfs_refcount_update_diff_items( struct xfs_refcount_intent *ra = ci_entry(a); struct xfs_refcount_intent *rb = ci_entry(b); - return ra->ri_group->xg_gno - rb->ri_group->xg_gno; + return cmp_int(ra->ri_group->xg_gno, rb->ri_group->xg_gno); } /* Log refcount updates in the intent item. */ diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c index a39fe08dcd8f..2a3a73a8566d 100644 --- a/fs/xfs/xfs_rmap_item.c +++ b/fs/xfs/xfs_rmap_item.c @@ -267,7 +267,7 @@ xfs_rmap_update_diff_items( struct xfs_rmap_intent *ra = ri_entry(a); struct xfs_rmap_intent *rb = ri_entry(b); - return ra->ri_group->xg_gno - rb->ri_group->xg_gno; + return cmp_int(ra->ri_group->xg_gno, rb->ri_group->xg_gno); } /* Log rmap updates in the intent item. */ |