gfs2: Fix invalid metadata access in punch_hole

In punch_hole(), when the offset lies in the final block for a given
height, there is no hole to punch, but the maximum size check fails to
detect that.  Consequently, punch_hole() will try to punch a hole beyond
the end of the metadata and fail.  Fix the maximum size check.

Signed-off-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>

diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index d9ccfd27e4f11fe4ecc7ce36981cbef469942847..643175498d1c3b53c2df2d994503ce07305a9fa1 100644 (file)
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -1718,7 +1718,8 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)
        struct buffer_head *dibh, *bh;
        struct gfs2_holder rd_gh;
        unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift;
-       u64 lblock = (offset + (1 << bsize_shift) - 1) >> bsize_shift;
+       unsigned int bsize = 1 << bsize_shift;
+       u64 lblock = (offset + bsize - 1) >> bsize_shift;
        __u16 start_list[GFS2_MAX_META_HEIGHT];
        __u16 __end_list[GFS2_MAX_META_HEIGHT], *end_list = NULL;
        unsigned int start_aligned, end_aligned;
@@ -1729,7 +1730,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)
        u64 prev_bnr = 0;
        __be64 *start, *end;
 
-       if (offset >= maxsize) {
+       if (offset + bsize - 1 >= maxsize) {
                /*
                 * The starting point lies beyond the allocated metadata;
                 * there are no blocks to deallocate.