Lukas Czerner
2011-Sep-05 14:34 UTC
[PATCH] btrfs: return EINVAL if start > total_bytes in fitrim ioctl
We should retirn EINVAL if the start is beyond the end of the file system in the btrfs_ioctl_fitrim(). Fix that by adding the appropriate check for it. Also in the btrfs_trim_fs() it is possible that len+start might overflow if big values are passed. Fix it by decrementing the len so that start+len is equal to the file system size in the worst case. Signed-off-by: Lukas Czerner <lczerner@redhat.com> --- fs/btrfs/ioctl.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 970977a..ad890ee 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -277,6 +277,7 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) struct fstrim_range range; u64 minlen = ULLONG_MAX; u64 num_devices = 0; + u64 total_bytes = btrfs_super_total_bytes(&root->fs_info->super_copy); int ret; if (!capable(CAP_SYS_ADMIN)) @@ -295,12 +296,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) } } rcu_read_unlock(); + if (!num_devices) return -EOPNOTSUPP; - if (copy_from_user(&range, arg, sizeof(range))) return -EFAULT; + if (range.start > total_bytes) + return -EINVAL; + range.len = min(range.len, total_bytes - range.start); range.minlen = max(range.minlen, minlen); ret = btrfs_trim_fs(root, &range); if (ret < 0) -- 1.7.4.4 -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
David Sterba
2011-Sep-22 10:15 UTC
Re: [PATCH] btrfs: return EINVAL if start > total_bytes in fitrim ioctl
On Mon, Sep 05, 2011 at 04:34:54PM +0200, Lukas Czerner wrote:> We should retirn EINVAL if the start is beyond the end of the file > system in the btrfs_ioctl_fitrim(). Fix that by adding the appropriate > check for it. > > Also in the btrfs_trim_fs() it is possible that len+start might overflow > if big values are passed. Fix it by decrementing the len so that start+len > is equal to the file system size in the worst case. > > Signed-off-by: Lukas Czerner <lczerner@redhat.com>Reviewed-by: David Sterba <dsterba@suse.cz>> --- > fs/btrfs/ioctl.c | 6 +++++- > 1 files changed, 5 insertions(+), 1 deletions(-) > > diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c > index 970977a..ad890ee 100644 > --- a/fs/btrfs/ioctl.c > +++ b/fs/btrfs/ioctl.c > @@ -277,6 +277,7 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) > struct fstrim_range range; > u64 minlen = ULLONG_MAX; > u64 num_devices = 0; > + u64 total_bytes = btrfs_super_total_bytes(&root->fs_info->super_copy); > int ret; > > if (!capable(CAP_SYS_ADMIN)) > @@ -295,12 +296,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) > } > } > rcu_read_unlock(); > + > if (!num_devices) > return -EOPNOTSUPP; > - > if (copy_from_user(&range, arg, sizeof(range))) > return -EFAULT; > + if (range.start > total_bytes) > + return -EINVAL; > > + range.len = min(range.len, total_bytes - range.start); > range.minlen = max(range.minlen, minlen); > ret = btrfs_trim_fs(root, &range); > if (ret < 0) > -- > 1.7.4.4 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html-- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html