[3/5] ceph: add additional offset check in ceph_write_iter()

Commit Message

Chengguang Xu July 18, 2018, 11:04 a.m. UTC

If the offset is larger or equal to both real file size and
max file size, then return -EFBIG.

Signed-off-by: Chengguang Xu <[e-mail]>
---
 fs/ceph/file.c | 9 +++++++++
 1 file changed, 9 insertions(+)

Patch

diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index e588b23681e0..7a01fe627bd7 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1387,9 +1387,11 @@  static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)
 	struct ceph_osd_client *osdc =
 		&ceph_sb_to_client(inode->i_sb)->client->osdc;
 	struct ceph_cap_flush *prealloc_cf;
+	struct ceph_fs_client *fsc = inode->i_sb->s_fs_info;
 	ssize_t count, written = 0;
 	int err, want, got;
 	loff_t pos;
+	loff_t limit = max(i_size_read(inode), fsc->max_file_size);
 
 	if (ceph_snap(inode) != CEPH_NOSNAP)
 		return -EROFS;
@@ -1415,6 +1417,13 @@  static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)
 		goto out;
 
 	pos = iocb->ki_pos;
+	if (unlikely(pos >= limit)) {
+		err = -EFBIG;
+		goto out;
+	} else {
+		iov_iter_truncate(from, limit - pos);
+	}
+
 	count = iov_iter_count(from);
 	if (ceph_quota_is_max_bytes_exceeded(inode, pos + count)) {
 		err = -EDQUOT;