fs: out of bounds on stack in iov_iter_advance

On Wed, Nov 11, 2015 at 10:19:48AM +0000, Al Viro wrote:

> I'll cook the minimal fixup for API change after I get some sleep and
> send it your way, unless somebody gets there first...

This should do it - switches ->ioctl() to pvfs2_inode_[gs]etxattr() and
converts xattr_handler ->[gs]et() to new API.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>

diff --git a/fs/orangefs/file.c b/fs/orangefs/file.c
index 78a46968a9946b61cb752a3a8859fb9ee1587c23..3a8140f289f64c587971a64ff450b1ba8d5ce468 100644 (file)
--- a/fs/orangefs/file.c
+++ b/fs/orangefs/file.c
@@ -506,11 +506,10 @@ static long pvfs2_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         */
        if (cmd == FS_IOC_GETFLAGS) {
                val = 0;
-               ret = pvfs2_xattr_get_default(file->f_path.dentry,
-                                             "user.pvfs2.meta_hint",
-                                             &val,
-                                             sizeof(val),
-                                             0);
+               ret = pvfs2_inode_getxattr(file_inode(file),
+                                          PVFS2_XATTR_NAME_DEFAULT_PREFIX,
+                                          "user.pvfs2.meta_hint",
+                                          &val, sizeof(val));
                if (ret < 0 && ret != -ENODATA)
                        return ret;
                else if (ret == -ENODATA)
@@ -540,12 +539,10 @@ static long pvfs2_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                gossip_debug(GOSSIP_FILE_DEBUG,
                             "pvfs2_ioctl: FS_IOC_SETFLAGS: %llu\n",
                             (unsigned long long)val);
-               ret = pvfs2_xattr_set_default(file->f_path.dentry,
-                                             "user.pvfs2.meta_hint",
-                                             &val,
-                                             sizeof(val),
-                                             0,
-                                             0);
+               ret = pvfs2_inode_setxattr(file_inode(file),
+                                          PVFS2_XATTR_NAME_DEFAULT_PREFIX,
+                                          "user.pvfs2.meta_hint",
+                                          &val, sizeof(val), 0);
        }
 
        return ret;

diff --git a/fs/orangefs/pvfs2-kernel.h b/fs/orangefs/pvfs2-kernel.h
index ac90b6365fd33f7ff73058da3362d84d3f0e585d..4295e263e25b153df3ac42d47571a0242a954d7c 100644 (file)
--- a/fs/orangefs/pvfs2-kernel.h
+++ b/fs/orangefs/pvfs2-kernel.h
@@ -234,19 +234,6 @@ extern const struct xattr_handler *pvfs2_xattr_handlers[];
 extern struct posix_acl *pvfs2_get_acl(struct inode *inode, int type);
 extern int pvfs2_set_acl(struct inode *inode, struct posix_acl *acl, int type);
 
-int pvfs2_xattr_set_default(struct dentry *dentry,
-                           const char *name,
-                           const void *buffer,
-                           size_t size,
-                           int flags,
-                           int handler_flags);
-
-int pvfs2_xattr_get_default(struct dentry *dentry,
-                           const char *name,
-                           void *buffer,
-                           size_t size,
-                           int handler_flags);
-
 /*
  * Redefine xtvec structure so that we could move helper functions out of
  * the define

diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
index 227eaa47b1e128c050308b277e0a1f1bdabe0b4f..b683daab742536dbc122c2715ee0c96f1db4e806 100644 (file)
--- a/fs/orangefs/xattr.c
+++ b/fs/orangefs/xattr.c
@@ -447,12 +447,12 @@ out_unlock:
        return ret;
 }
 
-int pvfs2_xattr_set_default(struct dentry *dentry,
-                           const char *name,
-                           const void *buffer,
-                           size_t size,
-                           int flags,
-                           int handler_flags)
+static int pvfs2_xattr_set_default(const struct xattr_handler *handler,
+                                  struct dentry *dentry,
+                                  const char *name,
+                                  const void *buffer,
+                                  size_t size,
+                                  int flags)
 {
        return pvfs2_inode_setxattr(dentry->d_inode,
                                    PVFS2_XATTR_NAME_DEFAULT_PREFIX,
@@ -462,11 +462,11 @@ int pvfs2_xattr_set_default(struct dentry *dentry,
                                    flags);
 }
 
-int pvfs2_xattr_get_default(struct dentry *dentry,
-                           const char *name,
-                           void *buffer,
-                           size_t size,
-                           int handler_flags)
+static int pvfs2_xattr_get_default(const struct xattr_handler *handler,
+                                  struct dentry *dentry,
+                                  const char *name,
+                                  void *buffer,
+                                  size_t size)
 {
        return pvfs2_inode_getxattr(dentry->d_inode,
                                    PVFS2_XATTR_NAME_DEFAULT_PREFIX,
@@ -476,12 +476,12 @@ int pvfs2_xattr_get_default(struct dentry *dentry,
 
 }
 
-static int pvfs2_xattr_set_trusted(struct dentry *dentry,
-                           const char *name,
-                           const void *buffer,
-                           size_t size,
-                           int flags,
-                           int handler_flags)
+static int pvfs2_xattr_set_trusted(const struct xattr_handler *handler,
+                                  struct dentry *dentry,
+                                  const char *name,
+                                  const void *buffer,
+                                  size_t size,
+                                  int flags)
 {
        return pvfs2_inode_setxattr(dentry->d_inode,
                                    PVFS2_XATTR_NAME_TRUSTED_PREFIX,
@@ -491,11 +491,11 @@ static int pvfs2_xattr_set_trusted(struct dentry *dentry,
                                    flags);
 }
 
-static int pvfs2_xattr_get_trusted(struct dentry *dentry,
-                           const char *name,
-                           void *buffer,
-                           size_t size,
-                           int handler_flags)
+static int pvfs2_xattr_get_trusted(const struct xattr_handler *handler,
+                                  struct dentry *dentry,
+                                  const char *name,
+                                  void *buffer,
+                                  size_t size)
 {
        return pvfs2_inode_getxattr(dentry->d_inode,
                                    PVFS2_XATTR_NAME_TRUSTED_PREFIX,