LU-4984 llite: check for integer overflow in hsm user request

[fs/lustre-release.git] / lustre / llite / dir.c

diff --git a/lustre/llite/dir.c b/lustre/llite/dir.c
index 48f8be8..cea0dd3 100644 (file)
--- a/lustre/llite/dir.c
+++ b/lustre/llite/dir.c
@@ -246,8 +246,14 @@ int ll_dir_read(struct inode *inode, __u64 *ppos, struct md_op_data *op_data,
                         * to access the 'ent' through its 'lde_name',
                         * so the parameter 'name' for 'filldir()' must
                         * be part of the 'ent'. */
+#ifdef HAVE_DIR_CONTEXT
+                       ctx->pos = lhash;
+                       done = !dir_emit(ctx, ent->lde_name, namelen, ino,
+                                        type);
+#else
                        done = filldir(cookie, ent->lde_name, namelen, lhash,
                                       ino, type);
+#endif
                }
 
                if (done) {
@@ -277,8 +283,11 @@ int ll_dir_read(struct inode *inode, __u64 *ppos, struct md_op_data *op_data,
                                               &chain);
                }
        }
-
+#ifdef HAVE_DIR_CONTEXT
+       ctx->pos = pos;
+#else
        *ppos = pos;
+#endif
        ll_dir_chain_fini(&chain);
        RETURN(rc);
 }
@@ -1645,7 +1654,7 @@ out_rmdir:
                RETURN(ll_fid2path(inode, (void *)arg));
        case LL_IOC_HSM_REQUEST: {
                struct hsm_user_request *hur;
-               int                      totalsize;
+               ssize_t                  totalsize;
 
                OBD_ALLOC_PTR(hur);
                if (hur == NULL)
@@ -1660,6 +1669,8 @@ out_rmdir:
                /* Compute the whole struct size */
                totalsize = hur_len(hur);
                OBD_FREE_PTR(hur);
+               if (totalsize < 0)
+                       RETURN(-E2BIG);
 
                /* Final size will be more than double totalsize */
                if (totalsize >= MDS_MAXREQSIZE / 3)