ksmbd: vfs: skip lock-range check on equal size to avoid size==0 underflow

[PATCH v2] ksmbd: vfs: skip lock-range check on equal size to avoid size==0 underflow

Posted by Qianchang Zhao 1 month, 1 week ago

When size equals the current i_size (including 0), the code used to call
check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1`
and can underflow for size==0. Skip the equal case.

Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
---
 fs/smb/server/vfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
index 891ed2dc2..d068b78a3 100644
--- a/fs/smb/server/vfs.c
+++ b/fs/smb/server/vfs.c
@@ -828,7 +828,7 @@ int ksmbd_vfs_truncate(struct ksmbd_work *work,
 		if (size < inode->i_size) {
 			err = check_lock_range(filp, size,
 					       inode->i_size - 1, WRITE);
-		} else {
+		} else if (size > inode->i_size) {
 			err = check_lock_range(filp, inode->i_size,
 					       size - 1, WRITE);
 		}
-- 
2.34.1

Re: [PATCH v2] ksmbd: vfs: skip lock-range check on equal size to avoid size==0 underflow

Posted by Namjae Jeon 1 month, 1 week ago

On Sun, Nov 9, 2025 at 12:57 AM Qianchang Zhao <pioooooooooip@gmail.com> wrote:
>
> When size equals the current i_size (including 0), the code used to call
> check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1`
> and can underflow for size==0. Skip the equal case.
>
> Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
> Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
Applied it to #ksmbd-for-next-next.
Thanks!