NFS: Prevent integer overflow in nfs_scan_list()

Also ensure that nfs_inode ncommit and npages are large enough to represent
all possible values for the number of pages.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ad90cbe76703caebf2ab4e9c8842f2f341f117f1..68f6bf1220061d9fa12f0bd641786d1485b67f8e 100644 (file)
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -425,6 +425,8 @@ int nfs_scan_list(struct nfs_inode *nfsi,
                                                req->wb_index, tag);
                                nfs_list_add_request(req, dst);
                                res++;
+                               if (res == INT_MAX)
+                                       goto out;
                        }
                }
 

diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index a942054767363e326b298d81dab2b7144243ba28..750708ccd708ae6922051e2e432a55873b49e84e 100644 (file)
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -158,7 +158,7 @@ struct nfs_inode {
        spinlock_t              req_lock;
        struct radix_tree_root  nfs_page_tree;
 
-       unsigned int            ncommit,
+       unsigned long           ncommit,
                                npages;
 
        /* Open contexts for shared mmap writes */