| Message ID | 20180530075951.32160-1-cgxu519@gmx.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Wed, May 30, 2018 at 9:59 AM, Chengguang Xu <cgxu519@gmx.com> wrote: > The check(intval < PAGE_SIZE) will involve type cast to intval, > so even when specifying negative value to rsize/wsize/readdir_max_bytes, > it will pass the validation check successfully. > > Signed-off-by: Chengguang Xu <cgxu519@gmx.com> > --- > v1->v2: > - strengthen the validation check for readdir_max_bytes as well. > > fs/ceph/super.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/fs/ceph/super.c b/fs/ceph/super.c > index b33082e6878f..d7e140830d0b 100644 > --- a/fs/ceph/super.c > +++ b/fs/ceph/super.c > @@ -256,12 +256,14 @@ static int parse_fsopt_token(char *c, void *private) > break; > /* misc */ > case Opt_wsize: > - if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) > + if (intval < 0 || > + intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) Cast PAGE_SIZE to int instead: intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE Thanks, Ilya -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
That also makes sense, thanks for your suggestion. I’ll fix in V3. > 在 2018年5月30日，下午4:18，Ilya Dryomov <idryomov@gmail.com> 写道： > > On Wed, May 30, 2018 at 9:59 AM, Chengguang Xu <cgxu519@gmx.com> wrote: >> The check(intval < PAGE_SIZE) will involve type cast to intval, >> so even when specifying negative value to rsize/wsize/readdir_max_bytes, >> it will pass the validation check successfully. >> >> Signed-off-by: Chengguang Xu <cgxu519@gmx.com> >> --- >> v1->v2: >> - strengthen the validation check for readdir_max_bytes as well. >> >> fs/ceph/super.c | 8 +++++--- >> 1 file changed, 5 insertions(+), 3 deletions(-) >> >> diff --git a/fs/ceph/super.c b/fs/ceph/super.c >> index b33082e6878f..d7e140830d0b 100644 >> --- a/fs/ceph/super.c >> +++ b/fs/ceph/super.c >> @@ -256,12 +256,14 @@ static int parse_fsopt_token(char *c, void *private) >> break; >> /* misc */ >> case Opt_wsize: >> - if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) >> + if (intval < 0 || >> + intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) > > Cast PAGE_SIZE to int instead: > > intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE > > Thanks, > > Ilya -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/ceph/super.c b/fs/ceph/super.c index b33082e6878f..d7e140830d0b 100644 --- a/fs/ceph/super.c +++ b/fs/ceph/super.c @@ -256,12 +256,14 @@ static int parse_fsopt_token(char *c, void *private) break; /* misc */ case Opt_wsize: - if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) + if (intval < 0 || + intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) return -EINVAL; fsopt->wsize = ALIGN(intval, PAGE_SIZE); break; case Opt_rsize: - if (intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) + if (intval < 0 || + intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) return -EINVAL; fsopt->rsize = ALIGN(intval, PAGE_SIZE); break; @@ -286,7 +288,7 @@ static int parse_fsopt_token(char *c, void *private) fsopt->max_readdir = intval; break; case Opt_readdir_max_bytes: - if (intval < PAGE_SIZE && intval != 0) + if (intval < 0 || (intval < PAGE_SIZE && intval != 0)) return -EINVAL; fsopt->max_readdir_bytes = intval; break;
The check(intval < PAGE_SIZE) will involve type cast to intval, so even when specifying negative value to rsize/wsize/readdir_max_bytes, it will pass the validation check successfully. Signed-off-by: Chengguang Xu <cgxu519@gmx.com> --- v1->v2: - strengthen the validation check for readdir_max_bytes as well. fs/ceph/super.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)