mirror of
https://github.com/torvalds/linux
synced 2024-10-14 23:39:09 +00:00
fs: Annotate struct file_handle with __counted_by() and use struct_size()
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). While there, use struct_size() helper, instead of the open-coded version. [brauner@kernel.org: contains a fix by Edward for an OOB access] Reported-by: syzbot+4139435cb1b34cf759c2@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> Link: https://lore.kernel.org/r/tencent_A7845DD769577306D813742365E976E3A205@qq.com Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/ZgImCXTdGDTeBvSS@neat Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
parent
61db088eeb
commit
68d6f4f3fb
|
@ -36,7 +36,7 @@ static long do_sys_name_to_handle(const struct path *path,
|
||||||
if (f_handle.handle_bytes > MAX_HANDLE_SZ)
|
if (f_handle.handle_bytes > MAX_HANDLE_SZ)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
|
||||||
handle = kzalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
|
handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
|
||||||
GFP_KERNEL);
|
GFP_KERNEL);
|
||||||
if (!handle)
|
if (!handle)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
@ -71,7 +71,7 @@ static long do_sys_name_to_handle(const struct path *path,
|
||||||
/* copy the mount id */
|
/* copy the mount id */
|
||||||
if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
|
if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
|
||||||
copy_to_user(ufh, handle,
|
copy_to_user(ufh, handle,
|
||||||
sizeof(struct file_handle) + handle_bytes))
|
struct_size(handle, f_handle, handle_bytes)))
|
||||||
retval = -EFAULT;
|
retval = -EFAULT;
|
||||||
kfree(handle);
|
kfree(handle);
|
||||||
return retval;
|
return retval;
|
||||||
|
@ -192,7 +192,7 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
|
||||||
retval = -EINVAL;
|
retval = -EINVAL;
|
||||||
goto out_err;
|
goto out_err;
|
||||||
}
|
}
|
||||||
handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
|
handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
|
||||||
GFP_KERNEL);
|
GFP_KERNEL);
|
||||||
if (!handle) {
|
if (!handle) {
|
||||||
retval = -ENOMEM;
|
retval = -ENOMEM;
|
||||||
|
|
|
@ -1033,7 +1033,7 @@ struct file_handle {
|
||||||
__u32 handle_bytes;
|
__u32 handle_bytes;
|
||||||
int handle_type;
|
int handle_type;
|
||||||
/* file identifier */
|
/* file identifier */
|
||||||
unsigned char f_handle[];
|
unsigned char f_handle[] __counted_by(handle_bytes);
|
||||||
};
|
};
|
||||||
|
|
||||||
static inline struct file *get_file(struct file *f)
|
static inline struct file *get_file(struct file *f)
|
||||||
|
|
Loading…
Reference in a new issue