From: sandeen@sandeen.net
To: xfs@oss.sgi.com
Subject: [patch 07/12] Fix xfs_bulkstat_one size checks & error handling
Date: Tue, 25 Nov 2008 21:20:12 -0600 [thread overview]
Message-ID: <20081126032028.571084174@sandeen.net> (raw)
In-Reply-To: 20081126032005.639750968@sandeen.net
[-- Attachment #1: bulkstat_one_size_and_error_fixes --]
[-- Type: text/plain, Size: 5452 bytes --]
The 32-bit xfs_blkstat_one handler was failing because
a size check checked whether the remaining (32-bit)
user buffer was less than the (64-bit) bulkstat buffer,
and failed with ENOMEM if so. Move this check
into the respective handlers so that they check the
correct sizes.
Also, the formatters were returning negative errors
or positive bytes copied; this was odd in the positive
error value world of xfs, and handled wrong by at least
some of the callers, which treated the bytes returned
as an error value. Move the bytes-used assignment
into the formatters.
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
--
Index: linux-2.6-xfs/fs/xfs/linux-2.6/xfs_ioctl32.c
===================================================================
--- linux-2.6-xfs.orig/fs/xfs/linux-2.6/xfs_ioctl32.c 2008-11-24 17:00:30.163063933 -0600
+++ linux-2.6-xfs/fs/xfs/linux-2.6/xfs_ioctl32.c 2008-11-24 17:09:27.181063641 -0600
@@ -193,35 +193,43 @@ xfs_bstime_store_compat(
return 0;
}
+/* Return 0 on success or positive error (to xfs_bulkstat()) */
STATIC int
xfs_bulkstat_one_fmt_compat(
void __user *ubuffer,
+ int ubsize,
+ int *ubused,
const xfs_bstat_t *buffer)
{
compat_xfs_bstat_t __user *p32 = ubuffer;
- if (put_user(buffer->bs_ino, &p32->bs_ino) ||
- put_user(buffer->bs_mode, &p32->bs_mode) ||
- put_user(buffer->bs_nlink, &p32->bs_nlink) ||
- put_user(buffer->bs_uid, &p32->bs_uid) ||
- put_user(buffer->bs_gid, &p32->bs_gid) ||
- put_user(buffer->bs_rdev, &p32->bs_rdev) ||
- put_user(buffer->bs_blksize, &p32->bs_blksize) ||
- put_user(buffer->bs_size, &p32->bs_size) ||
+ if (ubsize < sizeof(*p32))
+ return XFS_ERROR(ENOMEM);
+
+ if (put_user(buffer->bs_ino, &p32->bs_ino) ||
+ put_user(buffer->bs_mode, &p32->bs_mode) ||
+ put_user(buffer->bs_nlink, &p32->bs_nlink) ||
+ put_user(buffer->bs_uid, &p32->bs_uid) ||
+ put_user(buffer->bs_gid, &p32->bs_gid) ||
+ put_user(buffer->bs_rdev, &p32->bs_rdev) ||
+ put_user(buffer->bs_blksize, &p32->bs_blksize) ||
+ put_user(buffer->bs_size, &p32->bs_size) ||
xfs_bstime_store_compat(&p32->bs_atime, &buffer->bs_atime) ||
xfs_bstime_store_compat(&p32->bs_mtime, &buffer->bs_mtime) ||
xfs_bstime_store_compat(&p32->bs_ctime, &buffer->bs_ctime) ||
- put_user(buffer->bs_blocks, &p32->bs_blocks) ||
- put_user(buffer->bs_xflags, &p32->bs_xflags) ||
- put_user(buffer->bs_extsize, &p32->bs_extsize) ||
- put_user(buffer->bs_extents, &p32->bs_extents) ||
- put_user(buffer->bs_gen, &p32->bs_gen) ||
- put_user(buffer->bs_projid, &p32->bs_projid) ||
- put_user(buffer->bs_dmevmask, &p32->bs_dmevmask) ||
- put_user(buffer->bs_dmstate, &p32->bs_dmstate) ||
+ put_user(buffer->bs_blocks, &p32->bs_blocks) ||
+ put_user(buffer->bs_xflags, &p32->bs_xflags) ||
+ put_user(buffer->bs_extsize, &p32->bs_extsize) ||
+ put_user(buffer->bs_extents, &p32->bs_extents) ||
+ put_user(buffer->bs_gen, &p32->bs_gen) ||
+ put_user(buffer->bs_projid, &p32->bs_projid) ||
+ put_user(buffer->bs_dmevmask, &p32->bs_dmevmask) ||
+ put_user(buffer->bs_dmstate, &p32->bs_dmstate) ||
put_user(buffer->bs_aextents, &p32->bs_aextents))
- return -XFS_ERROR(EFAULT);
- return sizeof(*p32);
+ return XFS_ERROR(EFAULT);
+ if (ubused)
+ *ubused = sizeof(*p32);
+ return 0;
}
STATIC int
Index: linux-2.6-xfs/fs/xfs/xfs_itable.c
===================================================================
--- linux-2.6-xfs.orig/fs/xfs/xfs_itable.c 2008-11-24 17:00:30.168063416 -0600
+++ linux-2.6-xfs/fs/xfs/xfs_itable.c 2008-11-24 17:00:30.493043269 -0600
@@ -192,14 +192,21 @@ xfs_bulkstat_one_dinode(
}
}
+/* Return 0 on success or positive error */
STATIC int
xfs_bulkstat_one_fmt(
void __user *ubuffer,
+ int ubsize,
+ int *ubused,
const xfs_bstat_t *buffer)
{
+ if (ubsize < sizeof(*buffer))
+ return XFS_ERROR(ENOMEM);
if (copy_to_user(ubuffer, buffer, sizeof(*buffer)))
- return -EFAULT;
- return sizeof(*buffer);
+ return XFS_ERROR(EFAULT);
+ if (ubused)
+ *ubused = sizeof(*buffer);
+ return 0;
}
/*
@@ -227,8 +234,6 @@ xfs_bulkstat_one_int(
if (!buffer || xfs_internal_inum(mp, ino))
return XFS_ERROR(EINVAL);
- if (ubsize < sizeof(*buf))
- return XFS_ERROR(ENOMEM);
buf = kmem_alloc(sizeof(*buf), KM_SLEEP);
@@ -243,15 +248,11 @@ xfs_bulkstat_one_int(
xfs_bulkstat_one_dinode(mp, ino, dip, buf);
}
- error = formatter(buffer, buf);
- if (error < 0) {
- error = EFAULT;
+ error = formatter(buffer, ubsize, ubused, buf);
+ if (error)
goto out_free;
- }
*stat = BULKSTAT_RV_DIDONE;
- if (ubused)
- *ubused = error;
out_free:
kmem_free(buf);
Index: linux-2.6-xfs/fs/xfs/xfs_itable.h
===================================================================
--- linux-2.6-xfs.orig/fs/xfs/xfs_itable.h 2008-11-24 17:00:30.184607623 -0600
+++ linux-2.6-xfs/fs/xfs/xfs_itable.h 2008-11-24 17:00:30.509626060 -0600
@@ -71,6 +71,8 @@ xfs_bulkstat_single(
typedef int (*bulkstat_one_fmt_pf)( /* used size in bytes or negative error */
void __user *ubuffer, /* buffer to write to */
+ int ubsize, /* remaining user buffer sz */
+ int *ubused, /* bytes used by formatter */
const xfs_bstat_t *buffer); /* buffer to read from */
int
--
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
next prev parent reply other threads:[~2008-11-26 3:21 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-11-26 3:20 [patch 00/12] [PATCH V2]: compat ioctl fixes/cleanups/additions sandeen
2008-11-26 3:20 ` [patch 01/12] Move copy_from_user calls out of ioctl helpers into ioctl switch sandeen
2008-11-26 3:20 ` [patch 02/12] Move compat ioctl structs & numbers into xfs_ioctl32.h sandeen
2008-11-26 3:20 ` [patch 03/12] Clean up some existing compat ioctl calls sandeen
2008-11-26 3:20 ` [patch 04/12] Add compat handlers for swapext ioctl sandeen
2008-11-26 3:20 ` [patch 05/12] Add compat handlers for data & rt growfs ioctls sandeen
2008-11-26 3:20 ` [patch 06/12] Make the bulkstat_one compat ioctl handling more sane sandeen
2008-11-26 3:20 ` sandeen [this message]
2008-11-26 3:20 ` [patch 08/12] Fix compat XFS_IOC_FSBULKSTAT_SINGLE ioctl sandeen
2008-11-26 3:20 ` [patch 09/12] Hook up compat XFS_IOC_ATTRLIST_BY_HANDLE ioctl handler sandeen
2008-11-26 3:20 ` [patch 10/12] Hook up compat XFS_IOC_ATTRMULTI_BY_HANDLE " sandeen
2008-11-26 3:20 ` [patch 11/12] Hook up compat XFS_IOC_FSSETDM_BY_HANDLE " sandeen
2008-11-26 3:20 ` [patch 12/12] Reorder xfs_ioctl32.c for some tidiness sandeen
2008-11-26 14:40 ` [patch 00/12] [PATCH V2]: compat ioctl fixes/cleanups/additions Eric Sandeen
2008-11-26 15:07 ` Eric Sandeen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20081126032028.571084174@sandeen.net \
--to=sandeen@sandeen.net \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox