From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751934AbbD3PEJ (ORCPT ); Thu, 30 Apr 2015 11:04:09 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:40633 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750937AbbD3PEH (ORCPT ); Thu, 30 Apr 2015 11:04:07 -0400 Message-ID: <55424464.9030906@oracle.com> Date: Thu, 30 Apr 2015 11:04:04 -0400 From: Sasha Levin User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: linux-kernel@vger.kernel.org CC: Alexander Viro , linux-fsdevel@vger.kernel.org Subject: Re: [PATCH v2] vfs: read file_handle only once in handle_to_path References: <1422477048-4550-1-git-send-email-sasha.levin@oracle.com> In-Reply-To: <1422477048-4550-1-git-send-email-sasha.levin@oracle.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ping? On 01/28/2015 03:30 PM, Sasha Levin wrote: > We used to read file_handle twice. Once to get the amount of extra bytes, and > once to fetch the entire structure. > > This may be problematic since we do size verifications only after the first > read, so if the number of extra bytes changes in userspace between the first > and second calls, we'll have an incoherent view of file_handle. > > Instead, read the constant size once, and copy that over to the final > structure without having to re-read it again. > > Signed-off-by: Sasha Levin > --- > Change in v2: > - Use the f_handle pointer rather than size of struct > > fs/fhandle.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/fs/fhandle.c b/fs/fhandle.c > index 999ff5c..d59712d 100644 > --- a/fs/fhandle.c > +++ b/fs/fhandle.c > @@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, > goto out_err; > } > /* copy the full handle */ > - if (copy_from_user(handle, ufh, > - sizeof(struct file_handle) + > + *handle = f_handle; > + if (copy_from_user(&handle->f_handle, > + &ufh->f_handle, > f_handle.handle_bytes)) { > retval = -EFAULT; > goto out_handle; >