Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8db0c759 authored by Chengguang Xu's avatar Chengguang Xu Committed by Ilya Dryomov
Browse files

ceph: strengthen rsize/wsize/readdir_max_bytes validation 



The check (intval < PAGE_SIZE) will involve type cast, so even when
specifying negative value to rsize/wsize/readdir_max_bytes, it will
pass the validation check successfully.

Signed-off-by: default avatarChengguang Xu <cgxu519@gmx.com>
Reviewed-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent c36ed50d

fs/ceph/super.c

+3 −3
Original line number Diff line number Diff line
@@ -259,12 +259,12 @@ static int parse_fsopt_token(char *c, void *private) 
		break;

		/* misc */

	case Opt_wsize:

		if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE)

		if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE)

			return -EINVAL;

		fsopt->wsize = ALIGN(intval, PAGE_SIZE);

		break;

	case Opt_rsize:

		if (intval < PAGE_SIZE || intval > CEPH_MAX_READ_SIZE)

		if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_READ_SIZE)

			return -EINVAL;

		fsopt->rsize = ALIGN(intval, PAGE_SIZE);

		break;
@@ -289,7 +289,7 @@ static int parse_fsopt_token(char *c, void *private) 
		fsopt->max_readdir = intval;

		break;

	case Opt_readdir_max_bytes:

		if (intval < PAGE_SIZE && intval != 0)

		if (intval < (int)PAGE_SIZE && intval != 0)

			return -EINVAL;

		fsopt->max_readdir_bytes = intval;

		break;