Re: [PATCH] fs: clamp FIONREAD result to int range

[Jan Kara]

On Sat 31-10-26 09:22:09, Avi Weiss wrote:
> FIONREAD returns the difference between the file size and the current
> position in an int. When the difference is outside the int range, the
> result wraps, so a file with 4 GiB remaining can be reported as empty.
> 
> Clamp the result to the signed int range before returning it to userspace.
> Preserve negative counts for file positions past EOF.
> 
> Signed-off-by: Avi Weiss <thnkslprpt@xxxxxxxxx>

Fair enough. Feel free to add:

Reviewed-by: Jan Kara <jack@xxxxxxx>

								Honza

> ---
>  fs/ioctl.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ioctl.c b/fs/ioctl.c
> index 1c152c2b1b67d..ecc2a4cfe6100 100644
> --- a/fs/ioctl.c
> +++ b/fs/ioctl.c
> @@ -7,6 +7,7 @@
>  
>  #include <linux/syscalls.h>
>  #include <linux/mm.h>
> +#include <linux/minmax.h>
>  #include <linux/capability.h>
>  #include <linux/compat.h>
>  #include <linux/file.h>
> @@ -550,8 +551,8 @@ static int do_vfs_ioctl(struct file *filp, unsigned int fd,
>  		if (!S_ISREG(inode->i_mode) || IS_ANON_FILE(inode))
>  			return vfs_ioctl(filp, cmd, arg);
>  
> -		return put_user(i_size_read(inode) - filp->f_pos,
> -				(int __user *)argp);
> +		return put_user(clamp_t(loff_t, i_size_read(inode) - filp->f_pos,
> +					INT_MIN, INT_MAX), (int __user *)argp);
>  
>  	case FS_IOC_GETFLAGS:
>  		return ioctl_getflags(filp, argp);
> 
> base-commit: 36aad21d50d1af3f6954bb0c988257a908202477
> -- 
> 2.43.0
> 
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR