aboutsummaryrefslogtreecommitdiffstats
path: root/fs/fcntl.c
diff options
context:
space:
mode:
authorJeff Layton <jlayton@redhat.com>2017-11-14 14:42:57 -0500
committerJeff Layton <jlayton@redhat.com>2017-11-15 08:08:36 -0500
commit4d2dc2cc766c3b51929658cacbc6e34fc8e242fb (patch)
treecc8fca80ff984b268f9acedbb582f1f7a410ac69 /fs/fcntl.c
parentfcntl: don't leak fd reference when fixup_compat_flock fails (diff)
downloadlinux-dev-4d2dc2cc766c3b51929658cacbc6e34fc8e242fb.tar.xz
linux-dev-4d2dc2cc766c3b51929658cacbc6e34fc8e242fb.zip
fcntl: don't cap l_start and l_end values for F_GETLK64 in compat syscall
Currently, we're capping the values too low in the F_GETLK64 case. The fields in that structure are 64-bit values, so we shouldn't need to do any sort of fixup there. Make sure we check that assumption at build time in the future however by ensuring that the sizes we're copying will fit. With this, we no longer need COMPAT_LOFF_T_MAX either, so remove it. Fixes: 94073ad77fff2 (fs/locks: don't mess with the address limit in compat_fcntl64) Reported-by: Vitaly Lipatov <lav@etersoft.ru> Signed-off-by: Jeff Layton <jlayton@redhat.com> Reviewed-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'fs/fcntl.c')
-rw-r--r--fs/fcntl.c11
1 files changed, 5 insertions, 6 deletions
diff --git a/fs/fcntl.c b/fs/fcntl.c
index e15bcc4265d0..0522e283a4f4 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -563,6 +563,9 @@ static int put_compat_flock64(const struct flock *kfl, struct compat_flock64 __u
{
struct compat_flock64 fl;
+ BUILD_BUG_ON(sizeof(kfl->l_start) > sizeof(ufl->l_start));
+ BUILD_BUG_ON(sizeof(kfl->l_len) > sizeof(ufl->l_len));
+
memset(&fl, 0, sizeof(struct compat_flock64));
copy_flock_fields(&fl, kfl);
if (copy_to_user(ufl, &fl, sizeof(struct compat_flock64)))
@@ -641,12 +644,8 @@ COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
if (err)
break;
err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
- if (err)
- break;
- err = fixup_compat_flock(&flock);
- if (err)
- return err;
- err = put_compat_flock64(&flock, compat_ptr(arg));
+ if (!err)
+ err = put_compat_flock64(&flock, compat_ptr(arg));
break;
case F_SETLK:
case F_SETLKW: