| Message ID | 1501846878-10627-1-git-send-email-nborisov@suse.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Fri, Aug 04, 2017 at 02:41:18PM +0300, Nikolay Borisov wrote: > The buffer passed to btrfs_ioctl_tree_search* functions have to be at least > sizeof(struct btrfs_ioctl_search_header). If this is not the case then the > ioctl should return -EOVERFLOW and set the uarg->buf_size to the minimum > required size. Currently btrfs_ioctl_tree_search_v2 would return an -EOVERFLOW > error with ->buf_size being set to the value passed by user space. Fix this by > removing the size check and relying on search_ioctl, which already includes it > and correctly sets buf_size. > > Signed-off-by: Nikolay Borisov <nborisov@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index fa1b78cf25f6..e80950b3f340 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -2201,9 +2201,6 @@ static noinline int btrfs_ioctl_tree_search_v2(struct file *file, buf_size = args.buf_size; - if (buf_size < sizeof(struct btrfs_ioctl_search_header)) - return -EOVERFLOW; - /* limit result size to 16MB */ if (buf_size > buf_limit) buf_size = buf_limit;
The buffer passed to btrfs_ioctl_tree_search* functions have to be at least sizeof(struct btrfs_ioctl_search_header). If this is not the case then the ioctl should return -EOVERFLOW and set the uarg->buf_size to the minimum required size. Currently btrfs_ioctl_tree_search_v2 would return an -EOVERFLOW error with ->buf_size being set to the value passed by user space. Fix this by removing the size check and relying on search_ioctl, which already includes it and correctly sets buf_size. Signed-off-by: Nikolay Borisov <nborisov@suse.com> --- fs/btrfs/ioctl.c | 3 --- 1 file changed, 3 deletions(-)