ovl: check namelen

[mirror_ubuntu-artful-kernel.git] / fs / read_write.c

diff --git a/fs/read_write.c b/fs/read_write.c
index 66215a7b17cf14d0b776dbb8e62b310a1571fdeb..53bccd1c786e783b9e4083658a864a880c65c11f 100644 (file)
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -730,6 +730,35 @@ static ssize_t do_loop_readv_writev(struct file *filp, struct iov_iter *iter,
 /* A write operation does a read from user space and vice versa */
 #define vrfy_dir(type) ((type) == READ ? VERIFY_WRITE : VERIFY_READ)
 
+/**
+ * rw_copy_check_uvector() - Copy an array of &struct iovec from userspace
+ *     into the kernel and check that it is valid.
+ *
+ * @type: One of %CHECK_IOVEC_ONLY, %READ, or %WRITE.
+ * @uvector: Pointer to the userspace array.
+ * @nr_segs: Number of elements in userspace array.
+ * @fast_segs: Number of elements in @fast_pointer.
+ * @fast_pointer: Pointer to (usually small on-stack) kernel array.
+ * @ret_pointer: (output parameter) Pointer to a variable that will point to
+ *     either @fast_pointer, a newly allocated kernel array, or NULL,
+ *     depending on which array was used.
+ *
+ * This function copies an array of &struct iovec of @nr_segs from
+ * userspace into the kernel and checks that each element is valid (e.g.
+ * it does not point to a kernel address or cause overflow by being too
+ * large, etc.).
+ *
+ * As an optimization, the caller may provide a pointer to a small
+ * on-stack array in @fast_pointer, typically %UIO_FASTIOV elements long
+ * (the size of this array, or 0 if unused, should be given in @fast_segs).
+ *
+ * @ret_pointer will always point to the array that was used, so the
+ * caller must take care not to call kfree() on it e.g. in case the
+ * @fast_pointer array was used and it was allocated on the stack.
+ *
+ * Return: The total number of bytes covered by the iovec array on success
+ *   or a negative error code on error.
+ */
 ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
                              unsigned long nr_segs, unsigned long fast_segs,
                              struct iovec *fast_pointer,
@@ -1509,9 +1538,7 @@ ssize_t vfs_copy_file_range(struct file *file_in, loff_t pos_in,
        if (len == 0)
                return 0;
 
-       ret = mnt_want_write_file(file_out);
-       if (ret)
-               return ret;
+       sb_start_write(inode_out->i_sb);
 
        ret = -EOPNOTSUPP;
        if (file_out->f_op->copy_file_range)
@@ -1530,7 +1557,7 @@ ssize_t vfs_copy_file_range(struct file *file_in, loff_t pos_in,
        inc_syscr(current);
        inc_syscw(current);
 
-       mnt_drop_write_file(file_out);
+       sb_end_write(inode_out->i_sb);
 
        return ret;
 }
@@ -1628,15 +1655,19 @@ int vfs_clone_file_range(struct file *file_in, loff_t pos_in,
        struct inode *inode_out = file_inode(file_out);
        int ret;
 
-       if (inode_in->i_sb != inode_out->i_sb ||
-           file_in->f_path.mnt != file_out->f_path.mnt)
-               return -EXDEV;
-
        if (S_ISDIR(inode_in->i_mode) || S_ISDIR(inode_out->i_mode))
                return -EISDIR;
        if (!S_ISREG(inode_in->i_mode) || !S_ISREG(inode_out->i_mode))
                return -EINVAL;
 
+       /*
+        * FICLONE/FICLONERANGE ioctls enforce that src and dest files are on
+        * the same mount. Practically, they only need to be on the same file
+        * system.
+        */
+       if (inode_in->i_sb != inode_out->i_sb)
+               return -EXDEV;
+
        if (!(file_in->f_mode & FMODE_READ) ||
            !(file_out->f_mode & FMODE_WRITE) ||
            (file_out->f_flags & O_APPEND))
@@ -1656,10 +1687,6 @@ int vfs_clone_file_range(struct file *file_in, loff_t pos_in,
        if (pos_in + len > i_size_read(inode_in))
                return -EINVAL;
 
-       ret = mnt_want_write_file(file_out);
-       if (ret)
-               return ret;
-
        ret = file_in->f_op->clone_file_range(file_in, pos_in,
                        file_out, pos_out, len);
        if (!ret) {
@@ -1667,7 +1694,6 @@ int vfs_clone_file_range(struct file *file_in, loff_t pos_in,
                fsnotify_modify(file_out);
        }
 
-       mnt_drop_write_file(file_out);
        return ret;
 }
 EXPORT_SYMBOL(vfs_clone_file_range);