diff options
| author | Gerhard Heift <gerhard@heift.name> | 2014-01-30 16:23:58 +0100 |
|---|---|---|
| committer | Chris Mason <clm@fb.com> | 2014-06-12 18:21:26 -0700 |
| commit | 12544442882e13aee98126928bb3a1a141484fe8 (patch) | |
| tree | d8927e8ee3498c2362f38b328b73c3a37bcd77e1 | |
| parent | 25c9bc2e2bc9d67de7fc49ff2784cae5de755192 (diff) | |
| download | op-kernel-dev-12544442882e13aee98126928bb3a1a141484fe8.zip op-kernel-dev-12544442882e13aee98126928bb3a1a141484fe8.tar.gz | |
btrfs: tree_search, search_ioctl: accept varying buffer
rewrite search_ioctl to accept a buffer with varying size
Signed-off-by: Gerhard Heift <Gerhard@Heift.Name>
Signed-off-by: Chris Mason <clm@fb.com>
Acked-by: David Sterba <dsterba@suse.cz>
| -rw-r--r-- | fs/btrfs/ioctl.c | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 65148cd..7756404 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -1957,6 +1957,7 @@ static noinline int copy_to_sk(struct btrfs_root *root, struct btrfs_path *path, struct btrfs_key *key, struct btrfs_ioctl_search_key *sk, + size_t buf_size, char *buf, unsigned long *sk_offset, int *num_found) @@ -1989,11 +1990,10 @@ static noinline int copy_to_sk(struct btrfs_root *root, if (!key_in_sk(key, sk)) continue; - if (sizeof(sh) + item_len > BTRFS_SEARCH_ARGS_BUFSIZE) + if (sizeof(sh) + item_len > buf_size) item_len = 0; - if (sizeof(sh) + item_len + *sk_offset > - BTRFS_SEARCH_ARGS_BUFSIZE) { + if (sizeof(sh) + item_len + *sk_offset > buf_size) { ret = 1; goto out; } @@ -2040,17 +2040,21 @@ out: } static noinline int search_ioctl(struct inode *inode, - struct btrfs_ioctl_search_args *args) + struct btrfs_ioctl_search_key *sk, + size_t buf_size, + char *buf) { struct btrfs_root *root; struct btrfs_key key; struct btrfs_path *path; - struct btrfs_ioctl_search_key *sk = &args->key; struct btrfs_fs_info *info = BTRFS_I(inode)->root->fs_info; int ret; int num_found = 0; unsigned long sk_offset = 0; + if (buf_size < sizeof(struct btrfs_ioctl_search_header)) + return -EOVERFLOW; + path = btrfs_alloc_path(); if (!path) return -ENOMEM; @@ -2084,7 +2088,7 @@ static noinline int search_ioctl(struct inode *inode, ret = 0; goto err; } - ret = copy_to_sk(root, path, &key, sk, args->buf, + ret = copy_to_sk(root, path, &key, sk, buf_size, buf, &sk_offset, &num_found); btrfs_release_path(path); if (ret) @@ -2113,7 +2117,7 @@ static noinline int btrfs_ioctl_tree_search(struct file *file, return PTR_ERR(args); inode = file_inode(file); - ret = search_ioctl(inode, args); + ret = search_ioctl(inode, &args->key, sizeof(args->buf), args->buf); if (ret == 0 && copy_to_user(argp, args, sizeof(*args))) ret = -EFAULT; kfree(args); |
