UBUNTU: SAUCE: quota: Require that qids passed to dqget() be valid and map into s_user_ns

[mirror_ubuntu-zesty-kernel.git] / fs / quota / dquot.c

diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index a346bda8ca5602e0b820af12f30608c258b83f79..e3aeccd885f0d817cf3ea92df3da8226fd282beb 100644 (file)
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -834,6 +834,12 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid)
        unsigned int hashent = hashfn(sb, qid);
        struct dquot *dquot, *empty = NULL;
 
+       /* qid must be valid and must map into sb's userns */
+       if (!qid_valid(qid))
+               return ERR_PTR(-EINVAL);
+       if (from_kqid(sb->s_user_ns, qid) == (qid_t)-1)
+               return ERR_PTR(-EOVERFLOW);
+
         if (!sb_has_quota_active(sb, qid.type))
                return ERR_PTR(-ESRCH);
 we_slept: