btrfs: Fix -EOVERFLOW handling in btrfs_ioctl_tree_search_v2
authorNikolay Borisov <nborisov@suse.com>
Fri, 4 Aug 2017 11:41:18 +0000 (14:41 +0300)
committerDavid Sterba <dsterba@suse.com>
Fri, 18 Aug 2017 14:36:29 +0000 (16:36 +0200)
The buffer passed to btrfs_ioctl_tree_search* functions have to be at least
sizeof(struct btrfs_ioctl_search_header). If this is not the case then the
ioctl should return -EOVERFLOW and set the uarg->buf_size to the minimum
required size. Currently btrfs_ioctl_tree_search_v2 would return an -EOVERFLOW
error with ->buf_size being set to the value passed by user space. Fix this by
removing the size check and relying on search_ioctl, which already includes it
and correctly sets buf_size.

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
fs/btrfs/ioctl.c

index b21558bb12943cce36c416da1f72bf1168c44644..ae8fbf9d3de2ad0028ba2b1f5af81d4f3028f4ea 100644 (file)
@@ -2169,9 +2169,6 @@ static noinline int btrfs_ioctl_tree_search_v2(struct file *file,
 
        buf_size = args.buf_size;
 
-       if (buf_size < sizeof(struct btrfs_ioctl_search_header))
-               return -EOVERFLOW;
-
        /* limit result size to 16MB */
        if (buf_size > buf_limit)
                buf_size = buf_limit;