Skip to content

core: tee_ree_fs: fix handling of large file offsets #7925

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jenswikl merged 2 commits into from
Aug 20, 2026
Merged

core: tee_ree_fs: fix handling of large file offsets #7925

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
26a1dd2
core: tee_ree_fs: avoid narrowing file positions
ysbnim Aug 12, 2026
85e7358
core: tee_ree_fs: preserve physical offsets on 32-bit builds
ysbnim Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion core/include/tee/tee_fs_rpc.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ TEE_Result tee_fs_rpc_write_init(struct tee_fs_rpc_operation *op,
TEE_Result tee_fs_rpc_write_final(struct tee_fs_rpc_operation *op);


TEE_Result tee_fs_rpc_truncate(uint32_t id, int fd, size_t len);
TEE_Result tee_fs_rpc_truncate(uint32_t id, int fd, tee_fs_off_t len);
TEE_Result tee_fs_rpc_remove_dfh(uint32_t id,
const struct tee_fs_dirfile_fileh *dfh);
#endif /* __TEE_TEE_FS_RPC_H */
5 changes: 4 additions & 1 deletion core/tee/tee_fs_rpc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ TEE_Result tee_fs_rpc_write_final(struct tee_fs_rpc_operation *op)
return operation_commit(op);
}

TEE_Result tee_fs_rpc_truncate(uint32_t id, int fd, size_t len)
TEE_Result tee_fs_rpc_truncate(uint32_t id, int fd, tee_fs_off_t len)
{
struct tee_fs_rpc_operation op = {
.id = id, .num_params = 1, .params = {
Expand All @@ -186,6 +186,9 @@ TEE_Result tee_fs_rpc_truncate(uint32_t id, int fd, size_t len)
}
};

if (len < 0)
return TEE_ERROR_BAD_PARAMETERS;

return operation_commit(&op);
}

Expand Down
27 changes: 14 additions & 13 deletions core/tee/tee_ree_fs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ struct tee_fs_dir {
const TEE_UUID *uuid;
};

static int pos_to_block_num(int position)
static size_t pos_to_block_num(size_t position)
{
return position >> BLOCK_SHIFT;
}
Expand Down Expand Up @@ -142,12 +142,13 @@ static TEE_Result out_of_place_write(struct tee_fs_fd *fdp, size_t pos,
}

static TEE_Result get_offs_size(enum tee_fs_htree_type type, size_t idx,
uint8_t vers, size_t *offs, size_t *size)
uint8_t vers, tee_fs_off_t *offs, size_t *size)
{
const size_t node_size = sizeof(struct tee_fs_htree_node_image);
const size_t block_nodes = BLOCK_SIZE / (node_size * 2);
size_t pbn;
size_t bidx;
const uint64_t idx64 = idx;
uint64_t pbn = 0;
uint64_t bidx = 0;

assert(vers == 0 || vers == 1);

Expand Down Expand Up @@ -207,14 +208,14 @@ static TEE_Result get_offs_size(enum tee_fs_htree_type type, size_t idx,
*size = sizeof(struct tee_fs_htree_image);
return TEE_SUCCESS;
case TEE_FS_HTREE_TYPE_NODE:
pbn = 1 + ((idx / block_nodes) * block_nodes * 2);
pbn = 1 + (idx64 / block_nodes) * block_nodes * 2;
*offs = pbn * BLOCK_SIZE +
2 * node_size * (idx % block_nodes) +
2 * node_size * (idx64 % block_nodes) +
node_size * vers;
*size = node_size;
return TEE_SUCCESS;
case TEE_FS_HTREE_TYPE_BLOCK:
bidx = 2 * idx + vers;
bidx = 2 * idx64 + vers;
pbn = 2 + bidx + bidx / (block_nodes * 2 - 1);
*offs = pbn * BLOCK_SIZE;
*size = BLOCK_SIZE;
Expand All @@ -231,7 +232,7 @@ static TEE_Result ree_fs_rpc_read_init(void *aux,
{
struct tee_fs_fd *fdp = aux;
TEE_Result res;
size_t offs;
tee_fs_off_t offs = 0;
size_t size;

res = get_offs_size(type, idx, vers, &offs, &size);
Expand All @@ -249,7 +250,7 @@ static TEE_Result ree_fs_rpc_write_init(void *aux,
{
struct tee_fs_fd *fdp = aux;
TEE_Result res;
size_t offs;
tee_fs_off_t offs = 0;
size_t size;

res = get_offs_size(type, idx, vers, &offs, &size);
Expand Down Expand Up @@ -287,7 +288,7 @@ static TEE_Result ree_fs_ftruncate_internal(struct tee_fs_fd *fdp,
if (res != TEE_SUCCESS)
return res;
} else {
size_t offs;
tee_fs_off_t offs = 0;
size_t sz;

res = get_offs_size(TEE_FS_HTREE_TYPE_BLOCK,
Expand All @@ -302,7 +303,7 @@ static TEE_Result ree_fs_ftruncate_internal(struct tee_fs_fd *fdp,
return res;

res = tee_fs_rpc_truncate(OPTEE_RPC_CMD_FS, fdp->fd,
offs + sz);
offs + (tee_fs_off_t)sz);
if (res != TEE_SUCCESS)
return res;

Expand All @@ -318,8 +319,8 @@ static TEE_Result ree_fs_read_primitive(struct tee_file_handle *fh, size_t pos,
size_t *len)
{
TEE_Result res;
int start_block_num;
int end_block_num;
size_t start_block_num = 0;
size_t end_block_num = 0;
size_t remain_bytes;
uint8_t *data_core_ptr = buf_core;
uint8_t *data_user_ptr = buf_user;
Expand Down
Loading