-
Carlos Maiolino authored
FIBMAP receives an integer from userspace which is then implicitly converted into sector_t to be passed to bmap(). No check is made to ensure userspace didn't send a negative block number, which can end up in an underflow, and returning to userspace a corrupted block address. As a side-effect, the underflow caused by a negative block here, will trigger the WARN() in iomap_bmap_actor(), which is how this issue was first discovered. Reviewed-by:
Christoph Hellwig <hch@lst.de> Signed-off-by:
Carlos Maiolino <cmaiolino@redhat.com> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
324282c0