xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

btrfs: use u64 for buffer sizes in the tree search ioctls

Browse Source 
[ Upstream commit dec96fc2dcb59723e041416b8dc53e011b4bfc2e ]

In the tree search v2 ioctl we use the type size_t, which is an unsigned
long, to track the buffer size in the local variable 'buf_size'. An
unsigned long is 32 bits wide on a 32 bits architecture. The buffer size
defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later
try to copy the local variable 'buf_size' to the argument struct, when
the search returns -EOVERFLOW, we copy only 32 bits which will be a
problem on big endian systems.

Fix this by using a u64 type for the buffer sizes, not only at
btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain
so that we can use the u64 at btrfs_ioctl_tree_search_v2().

Fixes: cc68a8a5a4 ("btrfs: new ioctl TREE_SEARCH_V2")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/linux-btrfs/ce6f4bd6-9453-4ffe-ba00-cee35495e10f@moroto.mountain/
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Filipe Manana
2023-10-13 10:05:48 +01:00
committed by Greg Kroah-Hartman
parent 2bbbb976fa
commit 4be0407ffc
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
fs/btrfs/ioctl.c
View File

@@ -2104,7 +2104,7 @@ static noinline int key_in_sk(struct btrfs_key *key,
static noinline int copy_to_sk(struct btrfs_path *path, static noinline int copy_to_sk(struct btrfs_path *path,
struct btrfs_key *key, struct btrfs_key *key,
struct btrfs_ioctl_search_key *sk, struct btrfs_ioctl_search_key *sk,
size_t *buf_size, u64 *buf_size,
char __user *ubuf, char __user *ubuf,
unsigned long *sk_offset, unsigned long *sk_offset,
int *num_found) int *num_found)
@@ -2236,7 +2236,7 @@ out:
static noinline int search_ioctl(struct inode *inode, static noinline int search_ioctl(struct inode *inode,
struct btrfs_ioctl_search_key *sk, struct btrfs_ioctl_search_key *sk,
size_t *buf_size, u64 *buf_size,
char __user *ubuf) char __user *ubuf)
{ {
struct btrfs_fs_info *info = btrfs_sb(inode->i_sb); struct btrfs_fs_info *info = btrfs_sb(inode->i_sb);
@@ -2306,7 +2306,7 @@ static noinline int btrfs_ioctl_tree_search(struct file *file,
struct btrfs_ioctl_search_key sk; struct btrfs_ioctl_search_key sk;
struct inode *inode; struct inode *inode;
int ret; int ret;
size_t buf_size; u64 buf_size;
if (!capable(CAP_SYS_ADMIN)) if (!capable(CAP_SYS_ADMIN))
return -EPERM; return -EPERM;
@@ -2340,8 +2340,8 @@ static noinline int btrfs_ioctl_tree_search_v2(struct file *file,
struct btrfs_ioctl_search_args_v2 args; struct btrfs_ioctl_search_args_v2 args;
struct inode *inode; struct inode *inode;
int ret; int ret;
size_t buf_size; u64 buf_size;
const size_t buf_limit = SZ_16M; const u64 buf_limit = SZ_16M;
if (!capable(CAP_SYS_ADMIN)) if (!capable(CAP_SYS_ADMIN))
return -EPERM; return -EPERM;