2009-04-10 21:42:11

by Marcin Ślusarz

Subject: [PATCH] fuse: fix possible bug in fuse_direct_io on 64-bit system

Fix possible bug on 64-bit system when user requests > 4GB of data by
direct_io read/write, but provides smaller buffer.

(passing nbytes>4GB to fuse_get_user_pages truncates nbytes and get_user_pages
is called with wrong value of npages)

Found by gcc:
fs/fuse/file.c: In function 'fuse_direct_io':
fs/fuse/file.c:1002: warning: passing argument 3 of 'fuse_get_user_pages' from incompatible pointer type

Signed-off-by: Marcin Slusarz <[email protected]>
Cc: Miklos Szeredi <[email protected]>
---
fs/fuse/file.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 2b25133..0bb60c3 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -938,9 +938,9 @@ static void fuse_release_user_pages(struct fuse_req *req, int write)
}

static int fuse_get_user_pages(struct fuse_req *req, const char __user *buf,
- unsigned *nbytesp, int write)
+ size_t *nbytesp, int write)
{
- unsigned nbytes = *nbytesp;
+ size_t nbytes = *nbytesp;
unsigned long user_addr = (unsigned long) buf;
unsigned offset = user_addr & ~PAGE_MASK;
int npages;
@@ -955,7 +955,7 @@ static int fuse_get_user_pages(struct fuse_req *req, const char __user *buf,
return 0;
}

- nbytes = min(nbytes, (unsigned) FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
+ nbytes = min(nbytes, (size_t) FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
npages = (nbytes + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
npages = clamp(npages, 1, FUSE_MAX_PAGES_PER_REQ);
down_read(&current->mm->mmap_sem);
--

2009-04-11 22:11:59

by Miklos Szeredi

Subject: Re: [PATCH] fuse: fix possible bug in fuse_direct_io on 64-bit system

On Fri, 2009-04-10 at 23:41 +0200, Marcin Slusarz wrote:
> Fix possible bug on 64-bit system when user requests > 4GB of data by
> direct_io read/write, but provides smaller buffer.

Thanks. A similar patch is already queued for the next -rc:

http://git.kernel.org/?p=linux/kernel/git/mszeredi/fuse.git;a=commit;h=ce60a2f15764f296b0467960759351702c7d2986

Miklos