Skip to content

Commit dec96fc

Browse files
fdmananakdave
authored andcommitted
btrfs: use u64 for buffer sizes in the tree search ioctls
In the tree search v2 ioctl we use the type size_t, which is an unsigned long, to track the buffer size in the local variable 'buf_size'. An unsigned long is 32 bits wide on a 32 bits architecture. The buffer size defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later try to copy the local variable 'buf_size' to the argument struct, when the search returns -EOVERFLOW, we copy only 32 bits which will be a problem on big endian systems. Fix this by using a u64 type for the buffer sizes, not only at btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain so that we can use the u64 at btrfs_ioctl_tree_search_v2(). Fixes: cc68a8a ("btrfs: new ioctl TREE_SEARCH_V2") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/linux-btrfs/ce6f4bd6-9453-4ffe-ba00-cee35495e10f@moroto.mountain/ Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
1 parent c6e8f89 commit dec96fc

1 file changed

Lines changed: 5 additions & 5 deletions

File tree

fs/btrfs/ioctl.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1528,7 +1528,7 @@ static noinline int key_in_sk(struct btrfs_key *key,
15281528
static noinline int copy_to_sk(struct btrfs_path *path,
15291529
struct btrfs_key *key,
15301530
struct btrfs_ioctl_search_key *sk,
1531-
size_t *buf_size,
1531+
u64 *buf_size,
15321532
char __user *ubuf,
15331533
unsigned long *sk_offset,
15341534
int *num_found)
@@ -1660,7 +1660,7 @@ static noinline int copy_to_sk(struct btrfs_path *path,
16601660

16611661
static noinline int search_ioctl(struct inode *inode,
16621662
struct btrfs_ioctl_search_key *sk,
1663-
size_t *buf_size,
1663+
u64 *buf_size,
16641664
char __user *ubuf)
16651665
{
16661666
struct btrfs_fs_info *info = btrfs_sb(inode->i_sb);
@@ -1733,7 +1733,7 @@ static noinline int btrfs_ioctl_tree_search(struct inode *inode,
17331733
struct btrfs_ioctl_search_args __user *uargs = argp;
17341734
struct btrfs_ioctl_search_key sk;
17351735
int ret;
1736-
size_t buf_size;
1736+
u64 buf_size;
17371737

17381738
if (!capable(CAP_SYS_ADMIN))
17391739
return -EPERM;
@@ -1763,8 +1763,8 @@ static noinline int btrfs_ioctl_tree_search_v2(struct inode *inode,
17631763
struct btrfs_ioctl_search_args_v2 __user *uarg = argp;
17641764
struct btrfs_ioctl_search_args_v2 args;
17651765
int ret;
1766-
size_t buf_size;
1767-
const size_t buf_limit = SZ_16M;
1766+
u64 buf_size;
1767+
const u64 buf_limit = SZ_16M;
17681768

17691769
if (!capable(CAP_SYS_ADMIN))
17701770
return -EPERM;

0 commit comments

Comments
 (0)