Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f4c697e6 authored by Lukas Czerner's avatar Lukas Czerner Committed by David Sterba
Browse files

btrfs: return EINVAL if start > total_bytes in fitrim ioctl 



We should retirn EINVAL if the start is beyond the end of the file
system in the btrfs_ioctl_fitrim(). Fix that by adding the appropriate
check for it.

Also in the btrfs_trim_fs() it is possible that len+start might overflow
if big values are passed. Fix it by decrementing the len so that start+len
is equal to the file system size in the worst case.

Signed-off-by: default avatarLukas Czerner <lczerner@redhat.com>
parent 008873ea

fs/btrfs/ioctl.c

+5 −1
Original line number Diff line number Diff line
@@ -282,6 +282,7 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) 
	struct fstrim_range range;

	u64 minlen = ULLONG_MAX;

	u64 num_devices = 0;

	u64 total_bytes = btrfs_super_total_bytes(&root->fs_info->super_copy);

	int ret;



	if (!capable(CAP_SYS_ADMIN))
@@ -300,12 +301,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) 
		}

	}

	rcu_read_unlock();



	if (!num_devices)

		return -EOPNOTSUPP;



	if (copy_from_user(&range, arg, sizeof(range)))

		return -EFAULT;

	if (range.start > total_bytes)

		return -EINVAL;



	range.len = min(range.len, total_bytes - range.start);

	range.minlen = max(range.minlen, minlen);

	ret = btrfs_trim_fs(root, &range);

	if (ret < 0)