nilfs_sufile_get_suinfo() subtracts the caller-provided segment number from the total number of segments without first checking its range. If the requested number is greater than the total, the unsigned subtraction wraps and the function may process segment numbers outside the filesystem. Cache the total while holding the metadata semaphore and return no entries when the starting segment number is at or beyond the end. Fixes: 6c98cd4ecb0a ("nilfs2: segment usage file") Cc: stable@vger.kernel.org Signed-off-by: Aldo Ariel Panzardo --- fs/nilfs2/sufile.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c index eceedca026..573646c5f7 100644 --- a/fs/nilfs2/sufile.c +++ b/fs/nilfs2/sufile.c @@ -870,10 +870,14 @@ ssize_t nilfs_sufile_get_suinfo(struct inode *sufile, __u64 segnum, void *buf, down_read(&NILFS_MDT(sufile)->mi_sem); + nsegs = nilfs_sufile_get_nsegments(sufile); + if (segnum >= nsegs) { + ret = 0; + goto out; + } + segusages_per_block = nilfs_sufile_segment_usages_per_block(sufile); - nsegs = min_t(unsigned long, - nilfs_sufile_get_nsegments(sufile) - segnum, - nsi); + nsegs = min_t(unsigned long, nsegs - segnum, nsi); for (i = 0; i < nsegs; i += n, segnum += n) { n = min_t(unsigned long, segusages_per_block - -- 2.43.0