Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1ae7075b authored by Chris Snook's avatar Chris Snook Committed by Linus Torvalds
Browse files

use use SEEK_MAX to validate user lseek arguments 



Add SEEK_MAX and use it to validate lseek arguments from userspace.

Signed-off-by: default avatarChris Snook <csnook@redhat.com>
Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 7b8e8924

fs/read_write.c

+2 −2
Original line number Diff line number Diff line
@@ -139,7 +139,7 @@ asmlinkage off_t sys_lseek(unsigned int fd, off_t offset, unsigned int origin) 
		goto bad;



	retval = -EINVAL;

	if (origin <= 2) {

	if (origin <= SEEK_MAX) {

		loff_t res = vfs_llseek(file, offset, origin);

		retval = res;

		if (res != (loff_t)retval)
@@ -166,7 +166,7 @@ asmlinkage long sys_llseek(unsigned int fd, unsigned long offset_high, 
		goto bad;



	retval = -EINVAL;

	if (origin > 2)

	if (origin > SEEK_MAX)

		goto out_putf;



	offset = vfs_llseek(file, ((loff_t) offset_high << 32) | offset_low,

include/linux/fs.h

+1 −0
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ 
#define SEEK_SET	0	/* seek relative to beginning of file */

#define SEEK_CUR	1	/* seek relative to current file position */

#define SEEK_END	2	/* seek relative to end of file */

#define SEEK_MAX	SEEK_END



/* And dynamically-tunable limits and defaults: */

struct files_stat_struct {