Skip to content
  • Darrick J. Wong's avatar
    xfs: fix getfsmap userspace memory corruption while setting OF_LAST · 12e4a381
    Darrick J. Wong authored
    
    
    At the end of a getfsmap call, we will set FMR_OF_LAST in the last
    struct fsmap that was handed in by userspace if we've truly run out of
    space mapping record (as opposed to simply running out of space in the
    user array).  Unfortunately, fmh_entries is the wrong check for whether
    or not we've filled out anything in the user array because the ioctl
    provides that fmh_count==0 sets fmh_entries without filling out the user
    array.  Therefore we end up writing things into user memory areas that we
    weren't given, and kaboom.
    
    Since Christoph amended the getfsmap structure to track the number of
    fsmap entries we've actually filled out, use that as part of deciding if
    we have to set the OF_LAST flag.
    
    Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    12e4a381