Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a3956c7 authored by KAMEZAWA Hiroyuki's avatar KAMEZAWA Hiroyuki Committed by Al Viro
Browse files

vfs: introduce FMODE_UNSIGNED_OFFSET for allowing negative f_pos 



Now, rw_verify_area() checsk f_pos is negative or not.  And if negative,
returns -EINVAL.

But, some special files as /dev/(k)mem and /proc/<pid>/mem etc..  has
negative offsets.  And we can't do any access via read/write to the
file(device).

So introduce FMODE_UNSIGNED_OFFSET to allow negative file offsets.

Signed-off-by: default avatarWu Fengguang <fengguang.wu@intel.com>
Signed-off-by: default avatarKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent ba10f486

drivers/char/mem.c

+4 −0
Original line number Diff line number Diff line
@@ -876,6 +876,10 @@ static int memory_open(struct inode *inode, struct file *filp) 
	if (dev->dev_info)

		filp->f_mapping->backing_dev_info = dev->dev_info;



	/* Is /dev/mem or /dev/kmem ? */

	if (dev->dev_info == &directly_mappable_cdev_bdi)

		filp->f_mode |= FMODE_UNSIGNED_OFFSET;



	if (dev->fops->open)

		return dev->fops->open(inode, filp);

fs/proc/base.c

+2 −0
Original line number Diff line number Diff line
@@ -771,6 +771,8 @@ static const struct file_operations proc_single_file_operations = { 
static int mem_open(struct inode* inode, struct file* file)

{

	file->private_data = (void*)((long)current->self_exec_id);

	/* OK to pass negative loff_t, we can catch out-of-range */

	file->f_mode |= FMODE_UNSIGNED_OFFSET;

	return 0;

}

fs/read_write.c

+24 −4
Original line number Diff line number Diff line
@@ -31,6 +31,20 @@ const struct file_operations generic_ro_fops = { 


EXPORT_SYMBOL(generic_ro_fops);



static int

__negative_fpos_check(struct file *file, loff_t pos, size_t count)

{

	/*

	 * pos or pos+count is negative here, check overflow.

	 * too big "count" will be caught in rw_verify_area().

	 */

	if ((pos < 0) && (pos + count < pos))

		return -EOVERFLOW;

	if (file->f_mode & FMODE_UNSIGNED_OFFSET)

		return 0;

	return -EINVAL;

}



/**

 * generic_file_llseek_unlocked - lockless generic llseek implementation

 * @file:	file structure to seek on
@@ -62,7 +76,9 @@ generic_file_llseek_unlocked(struct file *file, loff_t offset, int origin) 
		break;

	}



	if (offset < 0 || offset > inode->i_sb->s_maxbytes)

	if (offset < 0 && __negative_fpos_check(file, offset, 0))

		return -EINVAL;

	if (offset > inode->i_sb->s_maxbytes)

		return -EINVAL;



	/* Special lock needed here? */
@@ -137,7 +153,7 @@ loff_t default_llseek(struct file *file, loff_t offset, int origin) 
			offset += file->f_pos;

	}

	retval = -EINVAL;

	if (offset >= 0) {

	if (offset >= 0 || !__negative_fpos_check(file, offset, 0)) {

		if (offset != file->f_pos) {

			file->f_pos = offset;

			file->f_version = 0;
@@ -221,6 +237,7 @@ SYSCALL_DEFINE5(llseek, unsigned int, fd, unsigned long, offset_high, 
}

#endif





/*

 * rw_verify_area doesn't like huge counts. We limit

 * them to something that fits in "int" so that others
@@ -238,8 +255,11 @@ int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count 
	if (unlikely((ssize_t) count < 0))

		return retval;

	pos = *ppos;

	if (unlikely((pos < 0) || (loff_t) (pos + count) < 0))

	if (unlikely((pos < 0) || (loff_t) (pos + count) < 0)) {

		retval = __negative_fpos_check(file, pos, count);

		if (retval)

			return retval;

	}



	if (unlikely(inode->i_flock && mandatory_lock(inode))) {

		retval = locks_mandatory_area(

include/linux/fs.h

+3 −0
Original line number Diff line number Diff line
@@ -92,6 +92,9 @@ struct inodes_stat_t { 
/* Expect random access pattern */

#define FMODE_RANDOM		((__force fmode_t)0x1000)



/* File is huge (eg. /dev/kmem): treat loff_t as unsigned */

#define FMODE_UNSIGNED_OFFSET	((__force fmode_t)0x2000)



/* File was opened by fanotify and shouldn't generate fanotify events */

#define FMODE_NONOTIFY		((__force fmode_t)0x1000000)