btrfs: use u64 for buffer sizes in the tree search ioctls

Commit Message

Filipe Manana Oct. 13, 2023, 9:05 a.m. UTC

From: Filipe Manana <[e-mail]>

In the tree search v2 ioctl we use the type size_t, which is an unsigned
long, to track the buffer size in the local variable 'buf_size'. An
unsigned long is 32 bits wide on a 32 bits architecture. The buffer size
defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later
try to copy the local variable 'buf_size' to the argument struct, when
the search returns -EOVERFLOW, we copy only 32 bits which will be a
problem on big endian systems.

Fix this by using a u64 type for the buffer sizes, not only at
btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain
so that we can use the u64 at btrfs_ioctl_tree_search_v2().

Fixes: cc68a8a5a433 ("btrfs: new ioctl TREE_SEARCH_V2")
Reported-by: Dan Carpenter <[e-mail]>
Link: https://lore.kernel.org/linux-btrfs/[e-mail]/
Signed-off-by: Filipe Manana <[e-mail]>
---
 fs/btrfs/ioctl.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Comments

David Sterba Oct. 13, 2023, 3:33 p.m. UTC | #1

On Fri, Oct 13, 2023 at 10:05:48AM +0100, [e-mail] wrote:
> From: Filipe Manana <[e-mail]>
> 
> In the tree search v2 ioctl we use the type size_t, which is an unsigned
> long, to track the buffer size in the local variable 'buf_size'. An
> unsigned long is 32 bits wide on a 32 bits architecture. The buffer size
> defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later
> try to copy the local variable 'buf_size' to the argument struct, when
> the search returns -EOVERFLOW, we copy only 32 bits which will be a
> problem on big endian systems.
> 
> Fix this by using a u64 type for the buffer sizes, not only at
> btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain
> so that we can use the u64 at btrfs_ioctl_tree_search_v2().
> 
> Fixes: cc68a8a5a433 ("btrfs: new ioctl TREE_SEARCH_V2")
> Reported-by: Dan Carpenter <[e-mail]>
> Link: https://lore.kernel.org/linux-btrfs/[e-mail]/
> Signed-off-by: Filipe Manana <[e-mail]>

Added to misc-next, thanks.

Patch

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index ab4ddbebeb16..130d863a5d01 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1528,7 +1528,7 @@  static noinline int key_in_sk(struct btrfs_key *key,
 static noinline int copy_to_sk(struct btrfs_path *path,
 			       struct btrfs_key *key,
 			       struct btrfs_ioctl_search_key *sk,
-			       size_t *buf_size,
+			       u64 *buf_size,
 			       char __user *ubuf,
 			       unsigned long *sk_offset,
 			       int *num_found)
@@ -1660,7 +1660,7 @@  static noinline int copy_to_sk(struct btrfs_path *path,
 
 static noinline int search_ioctl(struct inode *inode,
 				 struct btrfs_ioctl_search_key *sk,
-				 size_t *buf_size,
+				 u64 *buf_size,
 				 char __user *ubuf)
 {
 	struct btrfs_fs_info *info = btrfs_sb(inode->i_sb);
@@ -1733,7 +1733,7 @@  static noinline int btrfs_ioctl_tree_search(struct inode *inode,
 	struct btrfs_ioctl_search_args __user *uargs = argp;
 	struct btrfs_ioctl_search_key sk;
 	int ret;
-	size_t buf_size;
+	u64 buf_size;
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
@@ -1763,8 +1763,8 @@  static noinline int btrfs_ioctl_tree_search_v2(struct inode *inode,
 	struct btrfs_ioctl_search_args_v2 __user *uarg = argp;
 	struct btrfs_ioctl_search_args_v2 args;
 	int ret;
-	size_t buf_size;
-	const size_t buf_limit = SZ_16M;
+	u64 buf_size;
+	const u64 buf_limit = SZ_16M;
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;