Increase count limit in rw_verify_area().
Signed-off-by: Edward Shishkin <edward@xxxxxxxxxx>
---
fs/read_write.c | 17 +++++++----------
fs/splice.c | 4 ++--
include/linux/fs.h | 2 +-
3 files changed, 10 insertions(+), 13 deletions(-)
--- linux-2.6.36-rc7.orig/fs/read_write.c
+++ linux-2.6.36-rc7/fs/read_write.c
@@ -223,21 +223,20 @@ bad:
#endif
/*
- * rw_verify_area doesn't like huge counts. We limit
- * them to something that fits in "int" so that others
- * won't have to do range checks all the time.
+ * We limit huge counts to something that fits in "ssize_t"
*/
-#define MAX_RW_COUNT (INT_MAX & PAGE_CACHE_MASK)
+#define MAX_RW_COUNT ((~(size_t)0) >> 1 & PAGE_CACHE_MASK)
-int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count)
+ssize_t rw_verify_area(int read_write, struct file *file, loff_t *ppos,
+ size_t count)
{
struct inode *inode;
loff_t pos;
int retval = -EINVAL;
inode = file->f_path.dentry->d_inode;
- if (unlikely((ssize_t) count < 0))
- return retval;
+ if (unlikely(count > MAX_RW_COUNT))
+ count = MAX_RW_COUNT;
pos = *ppos;
if (unlikely((pos < 0) || (loff_t) (pos + count) < 0))
return retval;
@@ -251,9 +250,7 @@ int rw_verify_area(int read_write, struc
}
retval = security_file_permission(file,
read_write == READ ? MAY_READ : MAY_WRITE);
- if (retval)
- return retval;
- return count > MAX_RW_COUNT ? MAX_RW_COUNT : count;
+ return retval ? retval : count;
}
static void wait_on_retry_sync_kiocb(struct kiocb *iocb)
--- linux-2.6.36-rc7.orig/fs/splice.c
+++ linux-2.6.36-rc7/fs/splice.c
@@ -1097,7 +1097,7 @@ static long do_splice_from(struct pipe_i
{
ssize_t (*splice_write)(struct pipe_inode_info *, struct file *,
loff_t *, size_t, unsigned int);
- int ret;
+ ssize_t ret;
if (unlikely(!(out->f_mode & FMODE_WRITE)))
return -EBADF;
@@ -1126,7 +1126,7 @@ static long do_splice_to(struct file *in
{
ssize_t (*splice_read)(struct file *, loff_t *,
struct pipe_inode_info *, size_t, unsigned int);
- int ret;
+ ssize_t ret;
if (unlikely(!(in->f_mode & FMODE_READ)))
return -EBADF;
--- linux-2.6.36-rc7.orig/include/linux/fs.h
+++ linux-2.6.36-rc7/include/linux/fs.h
@@ -1824,7 +1824,7 @@ extern int current_umask(void);
/* /sys/fs */
extern struct kobject *fs_kobj;
-extern int rw_verify_area(int, struct file *, loff_t *, size_t);
+extern ssize_t rw_verify_area(int, struct file *, loff_t *, size_t);
#define FLOCK_VERIFY_READ 1
#define FLOCK_VERIFY_WRITE 2
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
