From 43620480d7b4ac578f5f9fd8465183b23e0d0dd1 Mon Sep 17 00:00:00 2001 From: Oleg Drokin Date: Tue, 12 Aug 2014 09:43:44 -0400 Subject: [PATCH] LU-4423 llite: Integer overflow in ll_ioctl_fiemap In ll_ioctl_fiemap(), a user-supplied value is used to calculate a length of a buffer which is later allocated with user data. Commit from upstream kernel 7bc3dfa37ba6f6ea81c362eb1993bd20c0828eae Change-Id: Ia1d255f9570fe1b136f1b0dd7caabe26b7b36665 Signed-off-by: Vitaly Osipov Signed-off-by: Oleg Drokin Reviewed-on: http://review.whamcloud.com/11413 Tested-by: Jenkins Reviewed-by: Dmitry Eremin Tested-by: Maloo Reviewed-by: James Simmons Reviewed-by: John L. Hammond --- lustre/include/linux/lustre_compat25.h | 4 ++++ lustre/llite/file.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/lustre/include/linux/lustre_compat25.h b/lustre/include/linux/lustre_compat25.h index 4ec8e55..5bebf47 100644 --- a/lustre/include/linux/lustre_compat25.h +++ b/lustre/include/linux/lustre_compat25.h @@ -361,4 +361,8 @@ static inline int radix_tree_exceptional_entry(void *arg) } #endif +#ifndef SIZE_MAX +#define SIZE_MAX (~(size_t)0) +#endif + #endif /* _COMPAT25_H */ diff --git a/lustre/llite/file.c b/lustre/llite/file.c index adf68ef..b29a9c6 100644 --- a/lustre/llite/file.c +++ b/lustre/llite/file.c @@ -1949,6 +1949,10 @@ static int ll_ioctl_fiemap(struct inode *inode, unsigned long arg) if (get_user(extent_count, &((struct ll_user_fiemap __user *)arg)->fm_extent_count)) RETURN(-EFAULT); + + if (extent_count >= + (SIZE_MAX - sizeof(*fiemap_s)) / sizeof(struct ll_fiemap_extent)) + RETURN(-EINVAL); num_bytes = sizeof(*fiemap_s) + (extent_count * sizeof(struct ll_fiemap_extent)); -- 1.8.3.1