Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030380AbVKCR4o (ORCPT ); Thu, 3 Nov 2005 12:56:44 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1030396AbVKCR4o (ORCPT ); Thu, 3 Nov 2005 12:56:44 -0500 Received: from MAIL.13thfloor.at ([212.16.62.50]:61353 "EHLO mail.13thfloor.at") by vger.kernel.org with ESMTP id S1030380AbVKCR4n (ORCPT ); Thu, 3 Nov 2005 12:56:43 -0500 Date: Thu, 3 Nov 2005 18:56:42 +0100 From: Herbert Poetzl To: Andrew Morton Cc: Linux Kernel ML Subject: do_sendfile ppos check ... Message-ID: <20051103175642.GB18015@MAIL.13thfloor.at> Mail-Followup-To: Andrew Morton , Linux Kernel ML Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.6i Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1540 Lines: 53 Hi Andrew! friend of mine stumbled over the following issue: do_sendfile() does an overflow check near the end, like this: if (*ppos > max) retval = -EOVERFLOW; now both sys_sendfile and sys_sendfile64 do call do_sendfile() similar to this: if (offset) { ... ret = do_sendfile(out_fd, in_fd, &pos, count, MAX_NON_LFS); return ret; } return do_sendfile(out_fd, in_fd, NULL, count, 0); which passes ppos as NULL, which in turn leads to an oops ... here is a patch (suggestion) to handle this properly, which also adjusts the max for sys_sendfile() (let me know what you think!) --- linux-2.6.14/fs/read_write.c 2005-10-28 20:49:45 +0200 +++ linux-2.6.14-sendfile/fs/read_write.c 2005-11-03 18:48:37 +0100 @@ -731,7 +731,8 @@ asmlinkage ssize_t sys_sendfile(int out_ return ret; } - return do_sendfile(out_fd, in_fd, NULL, count, 0); + pos = 0; + return do_sendfile(out_fd, in_fd, &pos, count, MAX_NON_LFS); } asmlinkage ssize_t sys_sendfile64(int out_fd, int in_fd, loff_t __user *offset, size_t count) @@ -748,5 +749,6 @@ asmlinkage ssize_t sys_sendfile64(int ou return ret; } - return do_sendfile(out_fd, in_fd, NULL, count, 0); + pos = 0; + return do_sendfile(out_fd, in_fd, &pos, count, 0); } - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/