From e39b29f8159a84f185556da587b6376d5d24eef5 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Wed, 4 Jan 2006 16:20:40 -0800 Subject: [PATCH] --- yaml --- r: 15423 b: refs/heads/master c: e28cc71572da38a5a12c1cfe4d7032017adccf69 h: refs/heads/master i: 15421: e569ad234d3a6cf8638c8b9b69f33e463ecaeeeb 15419: a3c4489eb16039e98fbeaeb52c447287aeefe932 15415: cc77342ad016c47757c372fabddfefabf02730b3 15407: d509177e3478e010afcfad75d38bc44401cf9152 15391: 66089a5e5804631d2228c231d117b16e0bdcd8fc 15359: dfd735e907a988f2f98c486fed98600a1869eb1d v: v3 --- [refs] | 2 +- trunk/arch/mips/kernel/linux32.c | 4 ++-- trunk/fs/compat.c | 2 +- trunk/fs/read_write.c | 34 +++++++++++++++++++++++--------- 4 files changed, 29 insertions(+), 13 deletions(-) diff --git a/[refs] b/[refs] index 285fbb0e6ebf..4945872b4ba6 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: a020ff412f0ecbb1e4aae1681b287e5785dd77b5 +refs/heads/master: e28cc71572da38a5a12c1cfe4d7032017adccf69 diff --git a/trunk/arch/mips/kernel/linux32.c b/trunk/arch/mips/kernel/linux32.c index 330cf84d21fe..60353f5acc48 100644 --- a/trunk/arch/mips/kernel/linux32.c +++ b/trunk/arch/mips/kernel/linux32.c @@ -420,7 +420,7 @@ asmlinkage ssize_t sys32_pread(unsigned int fd, char * buf, goto out; pos = merge_64(a4, a5); ret = rw_verify_area(READ, file, &pos, count); - if (ret) + if (ret < 0) goto out; ret = -EINVAL; if (!file->f_op || !(read = file->f_op->read)) @@ -455,7 +455,7 @@ asmlinkage ssize_t sys32_pwrite(unsigned int fd, const char * buf, goto out; pos = merge_64(a4, a5); ret = rw_verify_area(WRITE, file, &pos, count); - if (ret) + if (ret < 0) goto out; ret = -EINVAL; if (!file->f_op || !(write = file->f_op->write)) diff --git a/trunk/fs/compat.c b/trunk/fs/compat.c index 818634120b69..55ac0324aaf1 100644 --- a/trunk/fs/compat.c +++ b/trunk/fs/compat.c @@ -1170,7 +1170,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file, } ret = rw_verify_area(type, file, pos, tot_len); - if (ret) + if (ret < 0) goto out; fnv = NULL; diff --git a/trunk/fs/read_write.c b/trunk/fs/read_write.c index a091ee4f430d..df3468a22fea 100644 --- a/trunk/fs/read_write.c +++ b/trunk/fs/read_write.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include @@ -182,22 +183,33 @@ asmlinkage long sys_llseek(unsigned int fd, unsigned long offset_high, } #endif +/* + * rw_verify_area doesn't like huge counts. We limit + * them to something that fits in "int" so that others + * won't have to do range checks all the time. + */ +#define MAX_RW_COUNT (INT_MAX & PAGE_CACHE_MASK) int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count) { struct inode *inode; loff_t pos; - if (unlikely(count > INT_MAX)) + if (unlikely((ssize_t) count < 0)) goto Einval; pos = *ppos; if (unlikely((pos < 0) || (loff_t) (pos + count) < 0)) goto Einval; inode = file->f_dentry->d_inode; - if (inode->i_flock && MANDATORY_LOCK(inode)) - return locks_mandatory_area(read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE, inode, file, pos, count); - return 0; + if (inode->i_flock && MANDATORY_LOCK(inode)) { + int retval = locks_mandatory_area( + read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE, + inode, file, pos, count); + if (retval < 0) + return retval; + } + return count > MAX_RW_COUNT ? MAX_RW_COUNT : count; Einval: return -EINVAL; @@ -244,7 +256,8 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) return -EFAULT; ret = rw_verify_area(READ, file, pos, count); - if (!ret) { + if (ret >= 0) { + count = ret; ret = security_file_permission (file, MAY_READ); if (!ret) { if (file->f_op->read) @@ -295,7 +308,8 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_ return -EFAULT; ret = rw_verify_area(WRITE, file, pos, count); - if (!ret) { + if (ret >= 0) { + count = ret; ret = security_file_permission (file, MAY_WRITE); if (!ret) { if (file->f_op->write) @@ -497,7 +511,7 @@ static ssize_t do_readv_writev(int type, struct file *file, } ret = rw_verify_area(type, file, pos, tot_len); - if (ret) + if (ret < 0) goto out; ret = security_file_permission(file, type == READ ? MAY_READ : MAY_WRITE); if (ret) @@ -653,8 +667,9 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, if (!(in_file->f_mode & FMODE_PREAD)) goto fput_in; retval = rw_verify_area(READ, in_file, ppos, count); - if (retval) + if (retval < 0) goto fput_in; + count = retval; retval = security_file_permission (in_file, MAY_READ); if (retval) @@ -674,8 +689,9 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, goto fput_out; out_inode = out_file->f_dentry->d_inode; retval = rw_verify_area(WRITE, out_file, &out_file->f_pos, count); - if (retval) + if (retval < 0) goto fput_out; + count = retval; retval = security_file_permission (out_file, MAY_WRITE); if (retval)