sendfile calls lock_verify_area with wrong parameters
PATCH 1/1 sendfile calls lock_verify_area with wrong parameters
sendfile supports reading from a given start offset for in_file, like pread. But for the locks_verify_area call, in_file->f_pos is always used, even if a start offset is used. Result: wrong area is checked for mandatory locks.
Fix attached.
--
Manfred
fs/read_write.c +3 -4
@@ -544,6 +544,8 @@ssize_t retval;int fput_needed_in, fput_needed_out; +if (!ppos) + ppos = &in_file->f_pos;/* * Get input file, and verify that it is ok.. */
@@ -559,7 +561,7 @@ goto fput_in;if (!in_file->f_op || !in_file->f_op->sendfile) goto fput_in; - retval =locks_verify_area (FLOCK_VERIFY_READ , in_inode, in_file, in_file->f_pos, count); + retval =locks_verify_area (FLOCK_VERIFY_READ , in_inode, in_file, *ppos, count);if (retval) goto fput_in;
@@ -588,9 +590,6 @@if (retval) goto fput_out; -if (!ppos) - ppos = &in_file->f_pos; -if (!max) max =min (in_inode->i_sb->s_maxbytes, out_inode->i_sb->s_maxbytes);
Review
Quoted 4 lines · Manfred Spraul
(quoted diff) +2
-0+ if (!ppos) + ppos = &in_file->f_pos;
Too early - in_file not yet initialized.
An updated (and tested with 2.6.1-mm4) patch is attached - sorry for the noise.
--
Manfred
fs/read_write.c +3 -4
@@ -559,7 +559,9 @@ goto fput_in;if (!in_file->f_op || !in_file->f_op->sendfile) goto fput_in; - retval =locks_verify_area (FLOCK_VERIFY_READ , in_inode, in_file, in_file->f_pos, count); +if (!ppos) + ppos = &in_file->f_pos; + retval =locks_verify_area (FLOCK_VERIFY_READ , in_inode, in_file, *ppos, count);if (retval) goto fput_in;
@@ -588,9 +590,6 @@if (retval) goto fput_out; -if (!ppos) - ppos = &in_file->f_pos; -if (!max) max =min (in_inode->i_sb->s_maxbytes, out_inode->i_sb->s_maxbytes);