Skip to content

Commit

Permalink
btrfs: tree_search, copy_to_sk: return needed size on EOVERFLOW
Browse files Browse the repository at this point in the history
If an item in tree_search is too large to be stored in the given buffer, return
the needed size (including the header).

Signed-off-by: Gerhard Heift <Gerhard@Heift.Name>
Signed-off-by: Chris Mason <clm@fb.com>
Acked-by: David Sterba <dsterba@suse.cz>
  • Loading branch information
Gerhard Heift authored and Chris Mason committed Jun 13, 2014
1 parent 8f5f617 commit 9b6e817
Showing 1 changed file with 15 additions and 9 deletions.
24 changes: 15 additions & 9 deletions fs/btrfs/ioctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -1957,7 +1957,7 @@ static noinline int copy_to_sk(struct btrfs_root *root,
struct btrfs_path *path,
struct btrfs_key *key,
struct btrfs_ioctl_search_key *sk,
size_t buf_size,
size_t *buf_size,
char *buf,
unsigned long *sk_offset,
int *num_found)
Expand Down Expand Up @@ -1990,7 +1990,7 @@ static noinline int copy_to_sk(struct btrfs_root *root,
if (!key_in_sk(key, sk))
continue;

if (sizeof(sh) + item_len > buf_size) {
if (sizeof(sh) + item_len > *buf_size) {
if (*num_found) {
ret = 1;
goto out;
Expand All @@ -2001,11 +2001,12 @@ static noinline int copy_to_sk(struct btrfs_root *root,
* handle -EOVERFLOW
*/

*buf_size = sizeof(sh) + item_len;
item_len = 0;
ret = -EOVERFLOW;
}

if (sizeof(sh) + item_len + *sk_offset > buf_size) {
if (sizeof(sh) + item_len + *sk_offset > *buf_size) {
ret = 1;
goto out;
}
Expand Down Expand Up @@ -2056,7 +2057,7 @@ static noinline int copy_to_sk(struct btrfs_root *root,

static noinline int search_ioctl(struct inode *inode,
struct btrfs_ioctl_search_key *sk,
size_t buf_size,
size_t *buf_size,
char *buf)
{
struct btrfs_root *root;
Expand All @@ -2067,8 +2068,10 @@ static noinline int search_ioctl(struct inode *inode,
int num_found = 0;
unsigned long sk_offset = 0;

if (buf_size < sizeof(struct btrfs_ioctl_search_header))
if (*buf_size < sizeof(struct btrfs_ioctl_search_header)) {
*buf_size = sizeof(struct btrfs_ioctl_search_header);
return -EOVERFLOW;
}

path = btrfs_alloc_path();
if (!path)
Expand Down Expand Up @@ -2121,9 +2124,10 @@ static noinline int search_ioctl(struct inode *inode,
static noinline int btrfs_ioctl_tree_search(struct file *file,
void __user *argp)
{
struct btrfs_ioctl_search_args *args;
struct inode *inode;
int ret;
struct btrfs_ioctl_search_args *args;
struct inode *inode;
int ret;
size_t buf_size;

if (!capable(CAP_SYS_ADMIN))
return -EPERM;
Expand All @@ -2132,8 +2136,10 @@ static noinline int btrfs_ioctl_tree_search(struct file *file,
if (IS_ERR(args))
return PTR_ERR(args);

buf_size = sizeof(args->buf);

inode = file_inode(file);
ret = search_ioctl(inode, &args->key, sizeof(args->buf), args->buf);
ret = search_ioctl(inode, &args->key, &buf_size, args->buf);

/*
* In the origin implementation an overflow is handled by returning a
Expand Down

0 comments on commit 9b6e817

Please sign in to comment.