FIBMAP receives an integer from userspace which is then implicitly converted into sector_t on ->bmap(). No check is made to ensure userspace didn't send a negative address, which can confuse the ->bmap interface, and return fuzzy addresses. Signed-off-by: Carlos Maiolino <cmaiolino@xxxxxxxxxx> --- I am not 100% sure if is there any reason for ->bmap interface to accept negative values, from the top of my mind, I really can't see a reason, if there is a reason why we don't check for negative addresses, I'd be happy to know, otherwise we should reject it. Cheers fs/ioctl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ioctl.c b/fs/ioctl.c index fef3a6bf7c78..e3a01c43adb4 100644 --- a/fs/ioctl.c +++ b/fs/ioctl.c @@ -64,6 +64,11 @@ static int ioctl_fibmap(struct file *filp, int __user *p) res = get_user(block, p); if (res) return res; + + /* No reason to query a negative block addr */ + if (block < 0) + return -EINVAL; + res = mapping->a_ops->bmap(mapping, block); return put_user(res, p); } -- 2.20.1
