From: Zhang Yi Save orig_mlen after clamping map->m_len to INT_MAX. Otherwise, the unclamped value may be passed below, bypassing its overflow protection. Fixes: 5bb12b1837c0 ("ext4: Add support for EXT4_GET_BLOCKS_QUERY_LEAF_BLOCKS") Signed-off-by: Zhang Yi --- fs/ext4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index b71b1d2588ae..73af6d386985 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -703,7 +703,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode, struct extent_status es; int retval; int ret = 0; - unsigned int orig_mlen = map->m_len; + unsigned int orig_mlen; #ifdef ES_AGGRESSIVE_TEST struct ext4_map_blocks orig_map; @@ -719,6 +719,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode, */ if (unlikely(map->m_len > INT_MAX)) map->m_len = INT_MAX; + orig_mlen = map->m_len; /* We can handle the block number less than EXT_MAX_BLOCKS */ if (unlikely(map->m_lblk >= EXT_MAX_BLOCKS)) -- 2.52.0