headers
Tomas Racek | 9 Aug 2012 11:07
Picon
Favicon

[PATCH v3] xfs: check for possible overflow in xfs_ioc_trim

If range.start or range.minlen is bigger than filesystem size, return
invalid value error. This fixes possible overflow in BTOBB macro when
passed value was nearly ULLONG_MAX.

Signed-off-by: Tomas Racek <tracek <at> redhat.com>
---
 fs/xfs/xfs_discard.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
index f9c3fe3..4e07a56 100644
--- a/fs/xfs/xfs_discard.c
+++ b/fs/xfs/xfs_discard.c
 <at>  <at>  -179,12 +179,14  <at>  <at>  xfs_ioc_trim(
 	 * used by the fstrim application.  In the end it really doesn't
 	 * matter as trimming blocks is an advisory interface.
 	 */
+	if (range.start >= XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks) ||
+	    range.minlen > XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks))
+		return -XFS_ERROR(EINVAL);
+
 	start = BTOBB(range.start);
 	end = start + BTOBBT(range.len) - 1;
 	minlen = BTOBB(max_t(u64, granularity, range.minlen));

-	if (XFS_BB_TO_FSB(mp, start) >= mp->m_sb.sb_dblocks)
-		return -XFS_ERROR(EINVAL);
 	if (end > XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks) - 1)
 		end = XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks)- 1;
(Continue reading)

Permalink | Reply |
headers
Dave Chinner | 10 Aug 2012 01:47

Re: [PATCH v3] xfs: check for possible overflow in xfs_ioc_trim


[ Trimmed lkml from cc list.  There's no need to cc lkml on XFS
specific stuff. ]

[ Trimmed linux-xfs <at> vger.kernel.org as that is not a list any XFS
developer is subscribed to. ]

On Thu, Aug 09, 2012 at 11:07:09AM +0200, Tomas Racek wrote:
> If range.start or range.minlen is bigger than filesystem size, return
> invalid value error. This fixes possible overflow in BTOBB macro when
> passed value was nearly ULLONG_MAX.
> 
> Signed-off-by: Tomas Racek <tracek <at> redhat.com>
> ---
>  fs/xfs/xfs_discard.c |    6 ++++--
>  1 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
> index f9c3fe3..4e07a56 100644
> --- a/fs/xfs/xfs_discard.c
> +++ b/fs/xfs/xfs_discard.c
>  <at>  <at>  -179,12 +179,14  <at>  <at>  xfs_ioc_trim(
>  	 * used by the fstrim application.  In the end it really doesn't
>  	 * matter as trimming blocks is an advisory interface.
>  	 */
> +	if (range.start >= XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks) ||
> +	    range.minlen > XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks))
> +		return -XFS_ERROR(EINVAL);

That's not correct for minlen. The maximum minlen we can
(Continue reading)

Permalink | Reply |
headers
Tomas Racek | 13 Aug 2012 10:16
Picon
Favicon

Re: [PATCH v3] xfs: check for possible overflow in xfs_ioc_trim


> [ Trimmed lkml from cc list.  There's no need to cc lkml on XFS
> specific stuff. ]
> 
> [ Trimmed linux-xfs <at> vger.kernel.org as that is not a list any XFS
> developer is subscribed to. ]

Oh, it's good to know (I used get_maintainer script before).

> 
> On Thu, Aug 09, 2012 at 11:07:09AM +0200, Tomas Racek wrote:
> > If range.start or range.minlen is bigger than filesystem size,
> > return
> > invalid value error. This fixes possible overflow in BTOBB macro
> > when
> > passed value was nearly ULLONG_MAX.
> > 
> > Signed-off-by: Tomas Racek <tracek <at> redhat.com>
> > ---
> >  fs/xfs/xfs_discard.c |    6 ++++--
> >  1 files changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
> > index f9c3fe3..4e07a56 100644
> > --- a/fs/xfs/xfs_discard.c
> > +++ b/fs/xfs/xfs_discard.c
> >  <at>  <at>  -179,12 +179,14  <at>  <at>  xfs_ioc_trim(
> >  	 * used by the fstrim application.  In the end it really doesn't
> >  	 * matter as trimming blocks is an advisory interface.
> >  	 */
(Continue reading)

Permalink | Reply |

Gmane