summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authorriastradh <riastradh@NetBSD.org>2023-04-29 08:13:27 +0000
committerriastradh <riastradh@NetBSD.org>2023-04-29 08:13:27 +0000
commit2b92ee519d690df802ef2e7f349e90994c83dd81 (patch)
tree5fa3a8ab47d4ad56defc0aadc11088faabbab2b6 /sys
parentf3333f12cb7040ba9cb03fb9be4737d1dda653aa (diff)
tmpfs: Refuse sizes that overflow round_page.
Reported-by: syzbot+8dbeee84de15f86df65b@syzkaller.appspotmail.com https://syzkaller.appspot.com/bug?id=4a27b9fe074f8d4b0afbe22969339b8dfdb157e8
Diffstat (limited to 'sys')
-rw-r--r--sys/fs/tmpfs/tmpfs_subr.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/sys/fs/tmpfs/tmpfs_subr.c b/sys/fs/tmpfs/tmpfs_subr.c
index f3fb6a97b75..bda7db3d728 100644
--- a/sys/fs/tmpfs/tmpfs_subr.c
+++ b/sys/fs/tmpfs/tmpfs_subr.c
@@ -1,4 +1,4 @@
-/* $NetBSD: tmpfs_subr.c,v 1.115 2023/04/29 06:29:55 riastradh Exp $ */
+/* $NetBSD: tmpfs_subr.c,v 1.116 2023/04/29 08:13:27 riastradh Exp $ */
/*
* Copyright (c) 2005-2020 The NetBSD Foundation, Inc.
@@ -73,7 +73,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.115 2023/04/29 06:29:55 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.116 2023/04/29 08:13:27 riastradh Exp $");
#include <sys/param.h>
#include <sys/cprng.h>
@@ -907,6 +907,9 @@ tmpfs_reg_resize(struct vnode *vp, off_t newsize)
KASSERT(vp->v_type == VREG);
KASSERT(newsize >= 0);
+ if (newsize > __type_max(off_t) - PAGE_SIZE + 1)
+ return EFBIG;
+
oldsize = node->tn_size;
oldpages = round_page(oldsize) >> PAGE_SHIFT;
newpages = round_page(newsize) >> PAGE_SHIFT;