提交 50157b09 编写于 作者: A Alexandr Andreev 提交者: Tony Luck

[IA64] sync compat getdents

Add VERIFY_WRITE check in the beginning like compat_sys_getdents() (EINVAL vs
EFAULT).
Signed-off-by: NAlexandr Andreev <aandreev@openvz.org>
Signed-off-by: NAlexey Dobriyan <adobriyan@openvz.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NTony Luck <tony.luck@intel.com>
上级 a27e5a13
...@@ -1267,6 +1267,10 @@ sys32_getdents (unsigned int fd, struct compat_dirent __user *dirent, unsigned i ...@@ -1267,6 +1267,10 @@ sys32_getdents (unsigned int fd, struct compat_dirent __user *dirent, unsigned i
struct getdents32_callback buf; struct getdents32_callback buf;
int error; int error;
error = -EFAULT;
if (!access_ok(VERIFY_WRITE, dirent, count))
goto out;
error = -EBADF; error = -EBADF;
file = fget(fd); file = fget(fd);
if (!file) if (!file)
...@@ -1283,10 +1287,10 @@ sys32_getdents (unsigned int fd, struct compat_dirent __user *dirent, unsigned i ...@@ -1283,10 +1287,10 @@ sys32_getdents (unsigned int fd, struct compat_dirent __user *dirent, unsigned i
error = buf.error; error = buf.error;
lastdirent = buf.previous; lastdirent = buf.previous;
if (lastdirent) { if (lastdirent) {
error = -EINVAL;
if (put_user(file->f_pos, &lastdirent->d_off)) if (put_user(file->f_pos, &lastdirent->d_off))
goto out_putf; error = -EFAULT;
error = count - buf.count; else
error = count - buf.count;
} }
out_putf: out_putf:
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册