Commit bd8c7810 authored by Dan Carpenter's avatar Dan Carpenter Committed by Zheng Zengkai
Browse files

xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list() 

stable inclusion
from stable-v5.10.140
commit 6a564bad3a6474a5247491d2b48637ec69d429dd
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5W3GQ

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6a564bad3a6474a5247491d2b48637ec69d429dd



--------------------------------

commit 6ed6356b upstream.

The "bufsize" comes from the root user.  If "bufsize" is negative then,
because of type promotion, neither of the validation checks at the start
of the function are able to catch it:

	if (bufsize < sizeof(struct xfs_attrlist) ||
	    bufsize > XFS_XATTR_LIST_MAX)
		return -EINVAL;

This means "bufsize" will trigger (WARN_ON_ONCE(size > INT_MAX)) in
kvmalloc_node().  Fix this by changing the type from int to size_t.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarDarrick J. Wong <djwong@kernel.org>
Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
Signed-off-by: default avatarAmir Goldstein <amir73il@gmail.com>
Acked-by: default avatarDarrick J. Wong <djwong@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
Signed-off-by: default avatarGuo Xuenan <guoxuenan@huawei.com>
Reviewed-by: default avatarZhang Yi <yi.zhang@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent 02133c58

fs/xfs/xfs_ioctl.c

+1 −1
Original line number Diff line number Diff line
@@ -371,7 +371,7 @@ int 
xfs_ioc_attr_list(

	struct xfs_inode		*dp,

	void __user			*ubuf,

	int				bufsize,

	size_t				bufsize,

	int				flags,

	struct xfs_attrlist_cursor __user *ucursor)

{

fs/xfs/xfs_ioctl.h

+3 −2
Original line number Diff line number Diff line
@@ -38,8 +38,9 @@ xfs_readlink_by_handle( 
int xfs_ioc_attrmulti_one(struct file *parfilp, struct inode *inode,

		uint32_t opcode, void __user *uname, void __user *value,

		uint32_t *len, uint32_t flags);

int xfs_ioc_attr_list(struct xfs_inode *dp, void __user *ubuf, int bufsize,

	int flags, struct xfs_attrlist_cursor __user *ucursor);

int xfs_ioc_attr_list(struct xfs_inode *dp, void __user *ubuf,

		      size_t bufsize, int flags,

		      struct xfs_attrlist_cursor __user *ucursor);



extern struct dentry *

xfs_handle_to_dentry(