Btrfs: avoid stack bloat in btrfs_ioctl_fs_info()
PATCH 1/1 Btrfs: avoid stack bloat in btrfs_ioctl_fs_info()
The size of struct btrfs_ioctl_fs_info_args is as big as 1KB, so don't declare the variable on stack.
Signed-off-by Li Zefan <[email protected]>
--- fs/btrfs/ioctl.c | 23 ++++++++++++++--------- 1 files changed, 14 insertions(+), 9 deletions(-)
fs/btrfs/ioctl.c +14 -9
@@ -2054,29 +2054,34 @@ static long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg)static long btrfs_ioctl_fs_info (struct btrfs_root *root,void __user *arg) { -struct btrfs_ioctl_fs_info_args fi_args; +struct btrfs_ioctl_fs_info_args *fi_args;struct btrfs_device *device;struct btrfs_device *next;struct btrfs_fs_devices *fs_devices = root->fs_info->fs_devices; +int ret =0 ;if (!capable (CAP_SYS_ADMIN ))return -EPERM ; - fi_args.num_devices = fs_devices->num_devices; - fi_args.max_id =0 ; -memcpy (&fi_args.fsid, root->fs_info->fsid,sizeof (fi_args.fsid)); + fi_args =kzalloc (sizeof (*fi_args),GFP_KERNEL ); +if (!fi_args) +return -ENOMEM ; + + fi_args->num_devices = fs_devices->num_devices; +memcpy (&fi_args->fsid, root->fs_info->fsid,sizeof (fi_args->fsid));mutex_lock (&fs_devices->device_list_mutex);list_for_each_entry_safe (device, next, &fs_devices->devices, dev_list) { -if (device->devid > fi_args.max_id) - fi_args.max_id = device->devid; +if (device->devid > fi_args->max_id) + fi_args->max_id = device->devid; }mutex_unlock (&fs_devices->device_list_mutex); -if (copy_to_user (arg, &fi_args,sizeof (fi_args))) -return -EFAULT ; +if (copy_to_user (arg, fi_args,sizeof (fi_args))) + ret = -EFAULT ; -return 0 ; +kfree (fi_args); +return ret; }static long btrfs_ioctl_dev_info (struct btrfs_root *root,void __user *arg)
-- 1.7.3.1
Quoted 38 lines · Li Zefan
The size of struct
btrfs_ioctl_fs_info_argsis as big as 1KB, so don't declare the variable on stack.Signed-off-by Li Zefan <[email protected]>--- fs/btrfs/ioctl.c | 23 ++++++++++++++--------- 1 files changed, 14 insertions(+), 9 deletions(-)fs/btrfs/ioctl.c +8
-4@@ -2054,29 +2054,34 @@ static long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg)static long btrfs_ioctl_fs_info (struct btrfs_root *root,void __user *arg) { -struct btrfs_ioctl_fs_info_args fi_args; +struct btrfs_ioctl_fs_info_args *fi_args;struct btrfs_device *device;struct btrfs_device *next;struct btrfs_fs_devices *fs_devices = root->fs_info->fs_devices; +int ret =0 ;if (!capable (CAP_SYS_ADMIN ))return -EPERM ; - fi_args.num_devices = fs_devices->num_devices; - fi_args.max_id =0 ; -memcpy (&fi_args.fsid, root->fs_info->fsid,sizeof (fi_args.fsid)); + fi_args =kzalloc (sizeof (*fi_args),GFP_KERNEL ); +if (!fi_args) +return -ENOMEM ; + + fi_args->num_devices = fs_devices->num_devices; +memcpy (&fi_args->fsid, root->fs_info->fsid,sizeof (fi_args->fsid));mutex_lock (&fs_devices->device_list_mutex);list_for_each_entry_safe (device, next, &fs_devices->devices, dev_list) {
fs/btrfs/ioctl.c static long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg) · line 2080
Quoted 10 lines
fs/btrfs/ioctl.c +3
-4-if (device->devid > fi_args.max_id) - fi_args.max_id = device->devid; +if (device->devid > fi_args->max_id) + fi_args->max_id = device->devid; }mutex_unlock (&fs_devices->device_list_mutex); -if (copy_to_user (arg, &fi_args,sizeof (fi_args))) -return -EFAULT ; +if (copy_to_user (arg, fi_args,sizeof (fi_args)))
sizeof(*fi_args)
will integrate that, thanks :)
-Arne
Quoted 13 lines
fs/btrfs/ioctl.c +3
-3+ ret = -EFAULT ; -return 0 ; +kfree (fi_args); +return ret; }static long btrfs_ioctl_dev_info (struct btrfs_root *root,void __user *arg) -- 1.7.3.1 --To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 8 lines
fs/btrfs/ioctl.c static long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg) · line 2080
Quoted 3 lines
fs/btrfs/ioctl.c +1
-2-if (copy_to_user (arg, &fi_args,sizeof (fi_args))) -return -EFAULT ; +if (copy_to_user (arg, fi_args,sizeof (fi_args)))
sizeof(*fi_args)will integrate that, thanks :)
Oops, what a silly mistake!