From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasha Levin Subject: Re: [PATCH v2] vfs: read file_handle only once in handle_to_path Date: Thu, 30 Apr 2015 11:04:04 -0400 Message-ID: <55424464.9030906@oracle.com> References: <1422477048-4550-1-git-send-email-sasha.levin@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Cc: Alexander Viro , linux-fsdevel@vger.kernel.org To: linux-kernel@vger.kernel.org Return-path: Received: from aserp1040.oracle.com ([141.146.126.69]:40633 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750937AbbD3PEH (ORCPT ); Thu, 30 Apr 2015 11:04:07 -0400 In-Reply-To: <1422477048-4550-1-git-send-email-sasha.levin@oracle.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: ping? On 01/28/2015 03:30 PM, Sasha Levin wrote: > We used to read file_handle twice. Once to get the amount of extra bytes, and > once to fetch the entire structure. > > This may be problematic since we do size verifications only after the first > read, so if the number of extra bytes changes in userspace between the first > and second calls, we'll have an incoherent view of file_handle. > > Instead, read the constant size once, and copy that over to the final > structure without having to re-read it again. > > Signed-off-by: Sasha Levin > --- > Change in v2: > - Use the f_handle pointer rather than size of struct > > fs/fhandle.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/fs/fhandle.c b/fs/fhandle.c > index 999ff5c..d59712d 100644 > --- a/fs/fhandle.c > +++ b/fs/fhandle.c > @@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, > goto out_err; > } > /* copy the full handle */ > - if (copy_from_user(handle, ufh, > - sizeof(struct file_handle) + > + *handle = f_handle; > + if (copy_from_user(&handle->f_handle, > + &ufh->f_handle, > f_handle.handle_bytes)) { > retval = -EFAULT; > goto out_handle; >