[src/trunk]: src/sys/fs/tmpfs tmpfs: Refuse sizes that overflow round_page.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/6c3d29885340
branches:  trunk
changeset: 374507:6c3d29885340
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sat Apr 29 08:13:27 2023 +0000

description:
tmpfs: Refuse sizes that overflow round_page.

Reported-by: syzbot+8dbeee84de15f86df65b%syzkaller.appspotmail.com@localhost
https://syzkaller.appspot.com/bug?id=4a27b9fe074f8d4b0afbe22969339b8dfdb157e8

diffstat:

 sys/fs/tmpfs/tmpfs_subr.c |  7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diffs (28 lines):

diff -r 7450888f7155 -r 6c3d29885340 sys/fs/tmpfs/tmpfs_subr.c
--- a/sys/fs/tmpfs/tmpfs_subr.c Sat Apr 29 06:34:20 2023 +0000
+++ b/sys/fs/tmpfs/tmpfs_subr.c Sat Apr 29 08:13:27 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: tmpfs_subr.c,v 1.115 2023/04/29 06:29:55 riastradh Exp $       */
+/*     $NetBSD: tmpfs_subr.c,v 1.116 2023/04/29 08:13:27 riastradh Exp $       */
 
 /*
  * Copyright (c) 2005-2020 The NetBSD Foundation, Inc.
@@ -73,7 +73,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.115 2023/04/29 06:29:55 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.116 2023/04/29 08:13:27 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/cprng.h>
@@ -907,6 +907,9 @@ tmpfs_reg_resize(struct vnode *vp, off_t
        KASSERT(vp->v_type == VREG);
        KASSERT(newsize >= 0);
 
+       if (newsize > __type_max(off_t) - PAGE_SIZE + 1)
+               return EFBIG;
+
        oldsize = node->tn_size;
        oldpages = round_page(oldsize) >> PAGE_SHIFT;
        newpages = round_page(newsize) >> PAGE_SHIFT;