[PATCH] fibmap: Reject negative addresses

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


FIBMAP receives an integer from userspace which is then implicitly
converted into sector_t on ->bmap(). No check is made to ensure
userspace didn't send a negative address, which can confuse the ->bmap
interface, and return fuzzy addresses.

Signed-off-by: Carlos Maiolino <cmaiolino@xxxxxxxxxx>

I am not 100% sure if is there any reason for ->bmap interface to accept
negative values, from the top of my mind, I really can't see a reason, if there
is a reason why we don't check for negative addresses, I'd be happy to know,
otherwise we should reject it.


 fs/ioctl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ioctl.c b/fs/ioctl.c
index fef3a6bf7c78..e3a01c43adb4 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -64,6 +64,11 @@ static int ioctl_fibmap(struct file *filp, int __user *p)
 	res = get_user(block, p);
 	if (res)
 		return res;
+	/* No reason to query a negative block addr */
+	if (block < 0)
+		return -EINVAL;
 	res = mapping->a_ops->bmap(mapping, block);
 	return put_user(res, p);

[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux