public inbox for linux-xfs@vger.kernel.org
 help / color / mirror / Atom feed
From: "Darrick J. Wong" <darrick.wong@oracle.com>
To: Eric Sandeen <sandeen@redhat.com>
Cc: linux-xfs <linux-xfs@vger.kernel.org>, schumaker.anna@gmail.com
Subject: [PATCH v2] xfs_io: actually check copy file range helper return values
Date: Wed, 20 Feb 2019 09:16:15 -0800	[thread overview]
Message-ID: <20190220171615.GM32253@magnolia> (raw)
In-Reply-To: <b48c8b5d-9ed3-c4b6-c7fc-2c13df211dd3@redhat.com>

From: Darrick J. Wong <darrick.wong@oracle.com>

We need to check the return value of copy_src_filesize and
copy_dst_truncate because either could return -1 due to fstat/ftruncate
failure.

Fixes: 628e112afdd98c5 ("xfs_io: implement 'copy_range' command")
Cc: schumaker.anna@gmail.com
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
v2: fix return values and overflow problems
---
 io/copy_file_range.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/io/copy_file_range.c b/io/copy_file_range.c
index 4e2969c9..d069e5bb 100644
--- a/io/copy_file_range.c
+++ b/io/copy_file_range.c
@@ -120,11 +120,24 @@ copy_range_f(int argc, char **argv)
 		return 0;
 
 	if (src == 0 && dst == 0 && len == 0) {
-		len = copy_src_filesize(fd);
-		copy_dst_truncate();
+		off64_t	sz;
+
+		sz = copy_src_filesize(fd);
+		if (sz < 0 || (unsigned long long)sz > SIZE_MAX) {
+			ret = 1;
+			goto out;
+		}
+		len = sz;
+
+		ret = copy_dst_truncate();
+		if (ret < 0) {
+			ret = 1;
+			goto out;
+		}
 	}
 
 	ret = copy_file_range_cmd(fd, &src, &dst, len);
+out:
 	close(fd);
 	return ret;
 }

  parent reply	other threads:[~2019-02-20 17:16 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-02-19 23:12 [PATCH 0/3] xfsprogs: minor 4.20 fixups Eric Sandeen
2019-02-19 23:17 ` [PATCH 1/3] xfs_io: don't pass negative len to copy_file_range_cmd Eric Sandeen
2019-02-19 23:24   ` Darrick J. Wong
2019-02-19 23:50     ` Eric Sandeen
2019-02-20 17:16   ` Darrick J. Wong [this message]
2019-02-22 20:01     ` [PATCH v2] xfs_io: actually check copy file range helper return values Anna Schumaker
2019-02-19 23:23 ` [PATCH 2/3] xfs_io: fix TOCTOU in openfile() Eric Sandeen
2019-02-20  1:50   ` Dave Chinner
2019-02-20  4:41     ` Eric Sandeen
2019-02-20 17:23       ` Darrick J. Wong
2019-02-20 20:25         ` Eric Sandeen
2019-02-19 23:33 ` [PATCH 3/3] libhandle: zero terminate fspath string Eric Sandeen
2019-02-20 17:26   ` Darrick J. Wong

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190220171615.GM32253@magnolia \
    --to=darrick.wong@oracle.com \
    --cc=linux-xfs@vger.kernel.org \
    --cc=sandeen@redhat.com \
    --cc=schumaker.anna@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox