From patchwork Wed May 30 08:47:06 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chengguang Xu X-Patchwork-Id: 10437911 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 40A03602CC for ; Wed, 30 May 2018 08:47:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2B8AA288C3 for ; Wed, 30 May 2018 08:47:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1E71B288C6; Wed, 30 May 2018 08:47:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,FREEMAIL_FROM, MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 999FE288C3 for ; Wed, 30 May 2018 08:47:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935988AbeE3Irh (ORCPT ); Wed, 30 May 2018 04:47:37 -0400 Received: from mout.gmx.net ([212.227.17.21]:35121 "EHLO mout.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935951AbeE3Irf (ORCPT ); Wed, 30 May 2018 04:47:35 -0400 Received: from localhost.localdomain ([122.224.77.194]) by mail.gmx.com (mrgmx101 [212.227.17.174]) with ESMTPSA (Nemesis) id 0LorB9-1fzEb51HQJ-00gnpV; Wed, 30 May 2018 10:47:29 +0200 From: Chengguang Xu To: ceph-devel@vger.kernel.org Cc: zyan@redhat.com, idryomov@gmail.com, Chengguang Xu Subject: [PATCH v3] ceph: strengthen the validation check about rsize/wsize/readdir_max_bytes Date: Wed, 30 May 2018 16:47:06 +0800 Message-Id: <20180530084706.10038-1-cgxu519@gmx.com> X-Mailer: git-send-email 2.17.0 X-Provags-ID: V03:K1:8Mr93X60JazeWnPpvU9RDoR6EszAcj6nLK6tgAcBMdYaHgNbx0I 8R+PWWpi2uSgoRJqpGxWUY8leDkGFL97jK57bRpLv0+U+CjK8X4M1tCJwGy1f/p7ncI5mTg VyLhgyJzVa3eBcX90MijluhDjKdy+OUM8VK73VF6M5l84gUkREaumEnTrzOg19tGUm6OF6X hJQNXxgiVHQJLPk5bXT1g== X-UI-Out-Filterresults: notjunk:1; V01:K0:oqCluMMSmL0=:xN/6njvKJ87z7b8f3BXuHH 8QGAgh7A2NxAIKslNCRy/j9mo/TqW5Fh7eV3svQJufI9XOBriyR5yNmwI+S4+i7rZeJLU+UoK MzKDYuBVM4edH8YXgLUN/5Va8QWci5EcGWbVGMDp8i+ycieFEkCzOeXgsSc18lblRuBi8YYvt GiGs18qor8EfaQCYZAuXM7Vygr6eKDc2CWzT1sLhO7BoyF7KbGk9RC4jnEOYDCBMykIOAw23p bz5Kfat0khHf3TIxpnzrxVaO/XIT6UM/gcNaX7DqTBuFFEBUndDhJzpRG9ui770GCV9dOJElt pGb7WtaJtdKzP5F6keXwDQbEUx3NzA+MsMSz+fJRaqwUHoQl9Qz1cJqiiZiDlqR4DVMdqAa5j bv5Hw5I+xMpTJ4AD+tcW0H8bQu/W2vfpHcPYkPS8VMJMhIiu9yV8PIOpbvjVrcpCTu3MVrT/x i+A+dm4IvjkbVsY4osZvJ5ctCy6J8fxFF/fvgRHILICN3HBiaM8ElThGNeUjbJffu7y9teklz 2wW2dp9JpNeCjbbADvMnRqwpuHumM1+Gthp2IULyFKjLZYzeNy4tOabshVYibFGfznv87ASMb Qf9chGMTetFLo2mtgL5y+k3nCcQduS8M0lYlzgtVOuakHOe6BN6QFR5gH330oSSwLzM9c+/+q UY/68RTLrgsloQESC6MHMkFFrV9AgZKWdUgp8xvTksgkK/x2RhBQjz9k9VU66uQlD5Xj8Z5cH 5evIb021pTND3PFhCvsuw7fkn/iQLVDRvaF79kT6MbuE48kqPsalnVRtZh4= Sender: ceph-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: ceph-devel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The check(intval < PAGE_SIZE) will involve type cast to intval, so even when specifying negative value to rsize/wsize/readdir_max_bytes, it will pass the validation check successfully. Signed-off-by: Chengguang Xu --- v1->v2: - strengthen the validation check for readdir_max_bytes as well. v2->v3: - Cast PAGE_SIZE to int instead of adding additional check. fs/ceph/super.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/ceph/super.c b/fs/ceph/super.c index b33082e6878f..ed7901a7cf85 100644 --- a/fs/ceph/super.c +++ b/fs/ceph/super.c @@ -256,12 +256,12 @@ static int parse_fsopt_token(char *c, void *private) break; /* misc */ case Opt_wsize: - if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) + if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) return -EINVAL; fsopt->wsize = ALIGN(intval, PAGE_SIZE); break; case Opt_rsize: - if (intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) + if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_READ_SIZE) return -EINVAL; fsopt->rsize = ALIGN(intval, PAGE_SIZE); break; @@ -286,7 +286,7 @@ static int parse_fsopt_token(char *c, void *private) fsopt->max_readdir = intval; break; case Opt_readdir_max_bytes: - if (intval < PAGE_SIZE && intval != 0) + if (intval < (int)PAGE_SIZE && intval != 0) return -EINVAL; fsopt->max_readdir_bytes = intval; break;