diff options
| author | Kent Overstreet <kent.overstreet@gmail.com> | 2015-04-01 13:06:48 -0700 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@gmail.com> | 2016-10-07 12:33:50 -0800 |
| commit | 85abd3a75af94b0ecaabfe95b206e9b50d2fb1e3 (patch) | |
| tree | 9d4dff067ea727d785ddc7c58b596ca21474ecdd | |
| parent | 63dd1f5d034c15ed9a11cba55f1298a002222cb0 (diff) | |
bcache: Fix an overflow in bch_bset_fix_lookup_table()
Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
| -rw-r--r-- | drivers/md/bcache/bset.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c index 6dd76e98618e..fcbfb24bf641 100644 --- a/drivers/md/bcache/bset.c +++ b/drivers/md/bcache/bset.c @@ -757,16 +757,19 @@ static void bch_bset_fix_lookup_table(struct btree_keys *b, * have gotten too big */ for (; j < t->size; j++) { - t->prev[j] += shift; + /* Avoid overflow - might temporarily be larger than a u8 */ + unsigned p = (unsigned) t->prev[j] + shift; - if (t->prev[j] > 7) { + if (p > 7) { k = table_to_bkey(t, j - 1); while (k < cacheline_to_bkey(t, j, 0)) k = bkey_next(k); - t->prev[j] = bkey_to_cacheline_offset(t, j, k); + p = bkey_to_cacheline_offset(t, j, k); } + + t->prev[j] = p; } if (t->size == b->set->tree + btree_keys_cachelines(b) - t->tree) |