提交 6390460a 编写于 作者: A Aneesh Kumar K.V 提交者: Eric Van Hensbergen

net/9p: Handle error in zero copy request correctly for 9p2000.u

For zero copy request, error will be encoded in the user space buffer.
So copy the error code correctly using copy_from_user. Here we use the
extra bytes we allocate for zero copy request. If total error details
are more than P9_ZC_HDR_SZ - 7 bytes, we return -EFAULT. The patch also
avoid a memory allocation in the error path.
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
上级 c1be5a5b
......@@ -562,36 +562,19 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
if (!p9_is_proto_dotl(c)) {
/* Error is reported in string format */
uint16_t len;
/* 7 = header size for RERROR, 2 is the size of string len; */
int inline_len = in_hdrlen - (7 + 2);
int len;
/* 7 = header size for RERROR; */
int inline_len = in_hdrlen - 7;
/* Read the size of error string */
err = p9pdu_readf(req->rc, c->proto_version, "w", &len);
if (err)
goto out_err;
ename = kmalloc(len + 1, GFP_NOFS);
if (!ename) {
err = -ENOMEM;
len = req->rc->size - req->rc->offset;
if (len > (P9_ZC_HDR_SZ - 7)) {
err = -EFAULT;
goto out_err;
}
if (len <= inline_len) {
/* We have error in protocol buffer itself */
if (pdu_read(req->rc, ename, len)) {
err = -EFAULT;
goto out_free;
}
} else {
/*
* Part of the data is in user space buffer.
*/
if (pdu_read(req->rc, ename, inline_len)) {
err = -EFAULT;
goto out_free;
}
ename = &req->rc->sdata[req->rc->offset];
if (len > inline_len) {
/* We have error in external buffer */
if (kern_buf) {
memcpy(ename + inline_len, uidata,
len - inline_len);
......@@ -600,19 +583,19 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
uidata, len - inline_len);
if (err) {
err = -EFAULT;
goto out_free;
goto out_err;
}
}
}
ename[len] = 0;
if (p9_is_proto_dotu(c)) {
/* For dotu we also have error code */
err = p9pdu_readf(req->rc,
c->proto_version, "d", &ecode);
if (err)
goto out_free;
ename = NULL;
err = p9pdu_readf(req->rc, c->proto_version, "s?d",
&ename, &ecode);
if (err)
goto out_err;
if (p9_is_proto_dotu(c))
err = -ecode;
}
if (!err || !IS_ERR_VALUE(err)) {
err = p9_errstr2errno(ename, strlen(ename));
......@@ -628,8 +611,6 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
}
return err;
out_free:
kfree(ename);
out_err:
p9_debug(P9_DEBUG_ERROR, "couldn't parse error%d\n", err);
return err;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册