[PATCH] ufs: truncate negative to unsigned fix

During ufs_trunc_direct which is subroutine of ufs::truncate, we try the first
of all free parts of block and then whole blocks.  But we calculate size of
block's part to free in the wrong way.

This may cause bad update of used blocks and fragments statistic, and you can
got report that you have free 32T on 1Gb partition.

Signed-off-by: Evgeniy Dushistov <dushistov@mail.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/ufs/truncate.c b/fs/ufs/truncate.c
index ea11d04c41a07f07d6ed2151561b5dfc2b22cdd8..0437b0a6fe97f5ea9c5096f1a43ed4f554c4b475 100644 (file)
--- a/fs/ufs/truncate.c
+++ b/fs/ufs/truncate.c
@@ -109,10 +109,10 @@ static int ufs_trunc_direct (struct inode * inode)
        tmp = fs32_to_cpu(sb, *p);
        if (!tmp )
                ufs_panic (sb, "ufs_trunc_direct", "internal error");
+       frag2 -= frag1;
        frag1 = ufs_fragnum (frag1);
-       frag2 = ufs_fragnum (frag2);
 
-       ufs_free_fragments (inode, tmp + frag1, frag2 - frag1);
+       ufs_free_fragments(inode, tmp + frag1, frag2);
        mark_inode_dirty(inode);
        frag_to_free = tmp + frag1;