On Mon, 6 Aug 2018 12:22:03 +0200 Jan Kara [off-list ref] wrote:

On Fri 20-07-18 16:14:29, Andrew Morton wrote:

quoted

On Thu, 19 Jul 2018 10:58:12 +0200 Jan Kara [off-list ref] wrote:

quoted

On Thu 19-07-18 16:17:26, Chengguang Xu wrote:

quoted

When we try to truncate read count in generic_file_buffered_read(),
should deliver (sb->s_maxbytes - offset) as maximum count not
sb->s_maxbytes itself.

Signed-off-by: Chengguang Xu <redacted>

Looks good to me. You can add:

Reviewed-by: Jan Kara <jack@suse.cz>

Yup.

What are the runtime effects of this bug?

Good question. I think ->readpage() could be called for index beyond
maximum file size supported by the filesystem leading to weird filesystem
behavior due to overflows in internal calculations.

Sure.  But is it possible for userspace to trigger this behaviour? 
Possibly all callers have already sanitized the arguments by this stage
in which case the statement is arguably redundant.

I guess I'll put a cc:stable on it and send it in for 4.19-rc1, so we
get a bit more time to poke at it.  But we should have a better
understanding of the userspace impact.