Re: [PATCH 8/9] vfs: hoist the btrfs deduplication ioctl to the vfs
From: Kirill A. Shutemov <hidden>
Date: 2016-07-27 21:51:34
Also in:
linux-fsdevel, linux-xfs
On Sat, Dec 19, 2015 at 12:55:59AM -0800, Darrick J. Wong wrote:
quoted hunk ↗ jump to hunk
Hoist the btrfs EXTENT_SAME ioctl up to the VFS and make the name more systematic (FIDEDUPERANGE). Signed-off-by: Darrick J. Wong <redacted> --- fs/compat_ioctl.c | 1 fs/ioctl.c | 38 ++++++++++++++++++ fs/read_write.c | 100 +++++++++++++++++++++++++++++++++++++++++++++++ include/linux/fs.h | 4 ++ include/uapi/linux/fs.h | 30 ++++++++++++++ 5 files changed, 173 insertions(+)diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c index 70d4b10..eab31e7 100644 --- a/fs/compat_ioctl.c +++ b/fs/compat_ioctl.c@@ -1582,6 +1582,7 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, case FICLONE: case FICLONERANGE: + case FIDEDUPERANGE: goto do_ioctl; case FIBMAP:diff --git a/fs/ioctl.c b/fs/ioctl.c index 84c6e79..fcdd33b 100644 --- a/fs/ioctl.c +++ b/fs/ioctl.c@@ -568,6 +568,41 @@ static int ioctl_fsthaw(struct file *filp) return thaw_super(sb); } +static long ioctl_file_dedupe_range(struct file *file, void __user *arg) +{ + struct file_dedupe_range __user *argp = arg; + struct file_dedupe_range *same = NULL; + int ret; + unsigned long size; + u16 count; + + if (get_user(count, &argp->dest_count)) { + ret = -EFAULT; + goto out; + } + + size = offsetof(struct file_dedupe_range __user, info[count]);
Vlastimil triggered this during fuzzing: http://paste.opensuse.org/view/raw/99203426 High order allocation without __GFP_NOWARN + fallback. That's not good. Basically, we don't have any sanity check of 'dest_count' here. This u16 comes directly from userspace. And we call memdup_user() based on it. Here's a program which makes kernel allocate order-9 page: https://gist.github.com/kiryl/2b344b51da1fd2725be420a996b10d22 Should we put some reasonable upper limit for the 'dest_count'? What is typical 'dest_count'?
+
+ same = memdup_user(argp, size);
+ if (IS_ERR(same)) {
+ ret = PTR_ERR(same);
+ same = NULL;
+ goto out;
+ }
+
+ ret = vfs_dedupe_file_range(file, same);
+ if (ret)
+ goto out;
+
+ ret = copy_to_user(argp, same, size);
+ if (ret)
+ ret = -EFAULT;
+
+out:
+ kfree(same);
+ return ret;
+}
+-- Kirill A. Shutemov