Unverified Commit ec16b147 authored by Bart Van Assche's avatar Bart Van Assche Committed by Christian Brauner
Browse files

fs: Fix rw_hint validation 



Reject values that are valid rw_hints after truncation but not before
truncation by passing an untruncated value to rw_hint_valid().

Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarKanchan Joshi <joshi.k@samsung.com>
Cc: Jeff Layton <jlayton@kernel.org>
Cc: Chuck Lever <chuck.lever@oracle.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Fixes: 5657cb07 ("fs/fcntl: use copy_to/from_user() for u64 types")
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20240202203926.2478590-2-bvanassche@acm.org


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 6613476e

fs/fcntl.c

+5 −7
Original line number Diff line number Diff line
@@ -268,7 +268,7 @@ static int f_getowner_uids(struct file *filp, unsigned long arg) 
}

#endif



static bool rw_hint_valid(enum rw_hint hint)

static bool rw_hint_valid(u64 hint)

{

	switch (hint) {

	case RWH_WRITE_LIFE_NOT_SET:
@@ -288,19 +288,17 @@ static long fcntl_rw_hint(struct file *file, unsigned int cmd, 
{

	struct inode *inode = file_inode(file);

	u64 __user *argp = (u64 __user *)arg;

	enum rw_hint hint;

	u64 h;

	u64 hint;



	switch (cmd) {

	case F_GET_RW_HINT:

		h = inode->i_write_hint;

		if (copy_to_user(argp, &h, sizeof(*argp)))

		hint = inode->i_write_hint;

		if (copy_to_user(argp, &hint, sizeof(*argp)))

			return -EFAULT;

		return 0;

	case F_SET_RW_HINT:

		if (copy_from_user(&h, argp, sizeof(h)))

		if (copy_from_user(&hint, argp, sizeof(hint)))

			return -EFAULT;

		hint = (enum rw_hint) h;

		if (!rw_hint_valid(hint))

			return -EINVAL;