[PATCH 3/6] fs: ubootvarfs: range-check the new size in truncate

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum at barebox.org>

ubootvarfs_truncate() stores the size difference in an int and checks
the room left by forming a pointer that far past the end of the
environment. A size 4 GiB past the current one wraps to a difference of
zero, the truncate succeeds and the VFS records a 4 GiB file size. As
ubootvarfs_io() relies on the VFS to clamp reads and writes to that
size, md and mw on the variable then go well past the environment
buffer. A size 2 GiB past the current one wraps to a large negative
difference and the tail is moved 2 GiB below the buffer.

Let's keep the difference in a loff_t, compare it against the room left
instead of forming the pointer and reject negative sizes, which the
driver cannot handle either. The resize helpers take a ptrdiff_t now,
so the checked difference reaches them unchanged.

Fixes: 8daaa21b3949 ("fs: Add a driver to access U-Boot environment variables")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum at barebox.org>
---
 fs/ubootvarfs.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/fs/ubootvarfs.c b/fs/ubootvarfs.c
index a703f16a10f3..3b5c3039e3aa 100644
--- a/fs/ubootvarfs.c
+++ b/fs/ubootvarfs.c
@@ -197,7 +197,7 @@ static const struct file_operations ubootvarfs_dir_operations = {
  * zeroed out
  */
 static void ubootvarfs_relocate_tail(struct ubootvarfs_inode *node,
-				     int delta)
+				     ptrdiff_t delta)
 {
 	struct ubootvarfs_var *var = node->var;
 	struct ubootvarfs_data *data = node->data;
@@ -235,7 +235,7 @@ static void ubootvarfs_relocate_tail(struct ubootvarfs_inode *node,
  * ubootvarfs_var's in varaible linked list
  */
 static void ubootvarfs_adjust(struct ubootvarfs_inode *node,
-			      int delta)
+			      ptrdiff_t delta)
 {
 	struct ubootvarfs_var *var = node->var;
 	struct ubootvarfs_data *data = node->data;
@@ -260,7 +260,7 @@ static int ubootvarfs_unlink(struct inode *dir, struct dentry *dentry)
 		 * -1 at the end is to account for '\0' at the end
 		 * that needs to be removed as well
 		 */
-		const int delta = var->name - var->end - 1;
+		const ptrdiff_t delta = var->name - var->end - 1;
 
 		ubootvarfs_adjust(node, delta);
 
@@ -369,12 +369,16 @@ static int ubootvarfs_truncate(struct file *f, loff_t size)
 	struct ubootvarfs_inode *node = inode_to_node(inode);
 	struct ubootvarfs_data *data = node->data;
 	struct ubootvarfs_var *var = node->var;
-	const int delta = size - inode->i_size;
+	loff_t delta;
+
+	if (size < 0)
+		return -EINVAL;
 
 	if (size == inode->i_size)
 		return 0;
 
-	if (data->end + delta >= data->limit)
+	delta = size - inode->i_size;
+	if (delta >= data->limit - data->end)
 		return -ENOSPC;
 
 	ubootvarfs_adjust(node, delta);
-- 
2.47.3