btrfs: Fix -EOVERFLOW handling in btrfs_ioctl_tree_search_v2
diff mbox

Message ID 1501846878-10627-1-git-send-email-nborisov@suse.com
State New
Headers show

Commit Message

Nikolay Borisov Aug. 4, 2017, 11:41 a.m. UTC
The buffer passed to btrfs_ioctl_tree_search* functions have to be at least
sizeof(struct btrfs_ioctl_search_header). If this is not the case then the
ioctl should return -EOVERFLOW and set the uarg->buf_size to the minimum
required size. Currently btrfs_ioctl_tree_search_v2 would return an -EOVERFLOW
error with ->buf_size being set to the value passed by user space. Fix this by
removing the size check and relying on search_ioctl, which already includes it
and correctly sets buf_size.

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
---
 fs/btrfs/ioctl.c | 3 ---
 1 file changed, 3 deletions(-)

Comments

David Sterba Aug. 16, 2017, 1:05 p.m. UTC | #1
On Fri, Aug 04, 2017 at 02:41:18PM +0300, Nikolay Borisov wrote:
> The buffer passed to btrfs_ioctl_tree_search* functions have to be at least
> sizeof(struct btrfs_ioctl_search_header). If this is not the case then the
> ioctl should return -EOVERFLOW and set the uarg->buf_size to the minimum
> required size. Currently btrfs_ioctl_tree_search_v2 would return an -EOVERFLOW
> error with ->buf_size being set to the value passed by user space. Fix this by
> removing the size check and relying on search_ioctl, which already includes it
> and correctly sets buf_size.
> 
> Signed-off-by: Nikolay Borisov <nborisov@suse.com>

Reviewed-by: David Sterba <dsterba@suse.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index fa1b78cf25f6..e80950b3f340 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2201,9 +2201,6 @@  static noinline int btrfs_ioctl_tree_search_v2(struct file *file,
 
 	buf_size = args.buf_size;
 
-	if (buf_size < sizeof(struct btrfs_ioctl_search_header))
-		return -EOVERFLOW;
-
 	/* limit result size to 16MB */
 	if (buf_size > buf_limit)
 		buf_size = buf_limit;