| Message ID | 20180530070732.20592-1-cgxu519@gmx.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
I noticed option ‘readdir_max_bytes’ has same problem, I’ll add this one in V2. Thanks, Chengguang. > 在 2018年5月30日，下午3:07，Chengguang Xu <cgxu519@gmx.com> 写道： > > The check(intval < PAGE_SIZE) will involve type cast to intval, > so when specifying negative value to rsize/wsize, it will pass > the validation check successfully and eventually set to 0. > > Signed-off-by: Chengguang Xu <cgxu519@gmx.com> > --- > fs/ceph/super.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/fs/ceph/super.c b/fs/ceph/super.c > index b33082e6878f..c7fc588cef80 100644 > --- a/fs/ceph/super.c > +++ b/fs/ceph/super.c > @@ -256,12 +256,14 @@ static int parse_fsopt_token(char *c, void *private) > break; > /* misc */ > case Opt_wsize: > - if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) > + if (intval < 0 || > + intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) > return -EINVAL; > fsopt->wsize = ALIGN(intval, PAGE_SIZE); > break; > case Opt_rsize: > - if (intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) > + if (intval < 0 || > + intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) > return -EINVAL; > fsopt->rsize = ALIGN(intval, PAGE_SIZE); > break; > -- > 2.17.0 > -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/ceph/super.c b/fs/ceph/super.c index b33082e6878f..c7fc588cef80 100644 --- a/fs/ceph/super.c +++ b/fs/ceph/super.c @@ -256,12 +256,14 @@ static int parse_fsopt_token(char *c, void *private) break; /* misc */ case Opt_wsize: - if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) + if (intval < 0 || + intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) return -EINVAL; fsopt->wsize = ALIGN(intval, PAGE_SIZE); break; case Opt_rsize: - if (intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) + if (intval < 0 || + intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) return -EINVAL; fsopt->rsize = ALIGN(intval, PAGE_SIZE); break;
The check(intval < PAGE_SIZE) will involve type cast to intval, so when specifying negative value to rsize/wsize, it will pass the validation check successfully and eventually set to 0. Signed-off-by: Chengguang Xu <cgxu519@gmx.com> --- fs/ceph/super.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)