* [PATCH] btrfs: return EINVAL if start > total_bytes in fitrim ioctl
@ 2011-09-05 14:34 Lukas Czerner
2011-09-22 10:15 ` David Sterba
0 siblings, 1 reply; 2+ messages in thread
From: Lukas Czerner @ 2011-09-05 14:34 UTC (permalink / raw)
To: linux-btrfs; +Cc: jbacik, Lukas Czerner
We should retirn EINVAL if the start is beyond the end of the file
system in the btrfs_ioctl_fitrim(). Fix that by adding the appropriate
check for it.
Also in the btrfs_trim_fs() it is possible that len+start might overflow
if big values are passed. Fix it by decrementing the len so that start+len
is equal to the file system size in the worst case.
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
fs/btrfs/ioctl.c | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 970977a..ad890ee 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -277,6 +277,7 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
struct fstrim_range range;
u64 minlen = ULLONG_MAX;
u64 num_devices = 0;
+ u64 total_bytes = btrfs_super_total_bytes(&root->fs_info->super_copy);
int ret;
if (!capable(CAP_SYS_ADMIN))
@@ -295,12 +296,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
}
}
rcu_read_unlock();
+
if (!num_devices)
return -EOPNOTSUPP;
-
if (copy_from_user(&range, arg, sizeof(range)))
return -EFAULT;
+ if (range.start > total_bytes)
+ return -EINVAL;
+ range.len = min(range.len, total_bytes - range.start);
range.minlen = max(range.minlen, minlen);
ret = btrfs_trim_fs(root, &range);
if (ret < 0)
--
1.7.4.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] btrfs: return EINVAL if start > total_bytes in fitrim ioctl
2011-09-05 14:34 [PATCH] btrfs: return EINVAL if start > total_bytes in fitrim ioctl Lukas Czerner
@ 2011-09-22 10:15 ` David Sterba
0 siblings, 0 replies; 2+ messages in thread
From: David Sterba @ 2011-09-22 10:15 UTC (permalink / raw)
To: Lukas Czerner; +Cc: linux-btrfs, jbacik
On Mon, Sep 05, 2011 at 04:34:54PM +0200, Lukas Czerner wrote:
> We should retirn EINVAL if the start is beyond the end of the file
> system in the btrfs_ioctl_fitrim(). Fix that by adding the appropriate
> check for it.
>
> Also in the btrfs_trim_fs() it is possible that len+start might overflow
> if big values are passed. Fix it by decrementing the len so that start+len
> is equal to the file system size in the worst case.
>
> Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: David Sterba <dsterba@suse.cz>
> ---
> fs/btrfs/ioctl.c | 6 +++++-
> 1 files changed, 5 insertions(+), 1 deletions(-)
>
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 970977a..ad890ee 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -277,6 +277,7 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
> struct fstrim_range range;
> u64 minlen = ULLONG_MAX;
> u64 num_devices = 0;
> + u64 total_bytes = btrfs_super_total_bytes(&root->fs_info->super_copy);
> int ret;
>
> if (!capable(CAP_SYS_ADMIN))
> @@ -295,12 +296,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
> }
> }
> rcu_read_unlock();
> +
> if (!num_devices)
> return -EOPNOTSUPP;
> -
> if (copy_from_user(&range, arg, sizeof(range)))
> return -EFAULT;
> + if (range.start > total_bytes)
> + return -EINVAL;
>
> + range.len = min(range.len, total_bytes - range.start);
> range.minlen = max(range.minlen, minlen);
> ret = btrfs_trim_fs(root, &range);
> if (ret < 0)
> --
> 1.7.4.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-09-22 10:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-09-05 14:34 [PATCH] btrfs: return EINVAL if start > total_bytes in fitrim ioctl Lukas Czerner
2011-09-22 10:15 ` David Sterba
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.