From patchwork Wed May 30 07:07:32 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chengguang Xu X-Patchwork-Id: 10437729 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C1A31601D3 for ; Wed, 30 May 2018 07:08:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B0BF828867 for ; Wed, 30 May 2018 07:08:06 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9E28F28885; Wed, 30 May 2018 07:08:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,FREEMAIL_FROM, MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 062B828867 for ; Wed, 30 May 2018 07:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S968600AbeE3HIE (ORCPT ); Wed, 30 May 2018 03:08:04 -0400 Received: from mout.gmx.net ([212.227.17.21]:54523 "EHLO mout.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935905AbeE3HID (ORCPT ); Wed, 30 May 2018 03:08:03 -0400 Received: from localhost.localdomain ([122.224.77.194]) by mail.gmx.com (mrgmx102 [212.227.17.174]) with ESMTPSA (Nemesis) id 0MOCSm-1fREbJ0XEi-005ZZE; Wed, 30 May 2018 09:07:57 +0200 From: Chengguang Xu To: ceph-devel@vger.kernel.org Cc: zyan@redhat.com, idryomov@gmail.com, Chengguang Xu Subject: [PATCH] ceph: strengthen the validation check about rsize & wsize Date: Wed, 30 May 2018 15:07:32 +0800 Message-Id: <20180530070732.20592-1-cgxu519@gmx.com> X-Mailer: git-send-email 2.17.0 X-Provags-ID: V03:K1:ymxXOcyggPTowZQOl+uhE1rH/8btOu6V3RzgsWeAXlzVUYC/qXz VJhaEiKxwKGnn80/+bIikHqIYBX0bxfJFtwRhvgiZNgoYBhDJ+r/JvmCE2UcRzlZyC/9PyG aOifZzB3QoGLDCjAhwwlrf2jPeC193799xSEygjrnetpyqy5P1pUv1rdc1LkGfKyq31aJyw 9S5Muq9g/I2IrSjhwI6yw== X-UI-Out-Filterresults: notjunk:1; V01:K0:zsZEMydHdcs=:gal4Dxt+uCTQMMOXtGEs3c 06We41J3N3c9e1lZdOYLaDWaBodi83CwpCUXohvrXYVGupBNVgiCaOW+Tkn+CDB9du208Fahw QQXByPjYfTaM5DkyoayM0UaeBxgEyPTBJVLnm6SaAAsAgH4UFD5jlIrMJ0ealZnhvFNmxkDYW NDiLMKmfoqRZ61iXlutqD3lQdqI1JRwDmAe4CrNJWcmxr03ehiTICjBkaEkUP8x98AqmHmvvu yJOZ2TjczeFc/kQOKv0TUeInVH9swUiHR49tVdbkAoen5vbsMVaj4zTsOM9XIHLYYYYk6FYJo IFKfLdkxuBqytxDTIw39edno5QFCa5jG4Z4tWl7lV9YJ+A7g1zw6QUUVWqNhmxgvJXTb0cgC+ K0/hKt6MANlvQrsyKHkh8dk7jSnrMtLvxwDPFWFQYB5M+43Cl88WxnvW7KadpWPkAODsYNcEZ GAd577UULCjVH6EfzG3RCFRlIvR+fPgjqHyQ0WqiwobkEMXGgQxf0iCU08KXGgdnwPOOoyvwl 9DVQhOwSCX90xoLegovTdfoA4Lv//UGg+CTEtrGSYWDY/aZ8lpUK4JKuStfhetKx3VtZCRLb5 hYD9sDH7hyxQrpzwFhOdWqrmvW/uH5wu2jbpfbveIEw0utXRHZrws5WWWqcsNcaPl5JxwlrGS 0U0W4hafVfrPxejz4jQQRptOsirtUs7hrPJSxYuezk72xQHiYm6mt3oBgmpYIcOkMRz3D5bW4 OfmCGIiaDuXbKMJXFSUgfRO34nMCP3+KRLV+TELcvZX3fKsZsCxrny5rk2M= Sender: ceph-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: ceph-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The check(intval < PAGE_SIZE) will involve type cast to intval, so when specifying negative value to rsize/wsize, it will pass the validation check successfully and eventually set to 0. Signed-off-by: Chengguang Xu --- fs/ceph/super.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ceph/super.c b/fs/ceph/super.c index b33082e6878f..c7fc588cef80 100644 --- a/fs/ceph/super.c +++ b/fs/ceph/super.c @@ -256,12 +256,14 @@ static int parse_fsopt_token(char *c, void *private) break; /* misc */ case Opt_wsize: - if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) + if (intval < 0 || + intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) return -EINVAL; fsopt->wsize = ALIGN(intval, PAGE_SIZE); break; case Opt_rsize: - if (intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) + if (intval < 0 || + intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) return -EINVAL; fsopt->rsize = ALIGN(intval, PAGE_SIZE); break;