From 71cd98395789829b79dc6e748046549fb9e90135 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Mon, 28 Jan 2019 22:55:41 -0800 Subject: fs: Do not use IS_ERR_VALUE() to validate offset in lseek() On 32-bit systems, checking for IS_ERR_VALUE(pos) is not correct. Expanding that code we get (loff_t cast is added for clarity): (loff_t)pos >= (unsigned long)-MAX_ERRNO given that loff_t is a 64-bit signed value, any perfectly valid seek offset that is greater than 0xffffc000 will result in false positive. Moreso, as a part of fix introduced in e10efc5080 ("fs: fix memory access via /dev/mem for MIPS64") it doesn't really solve the problem completely on on 64-bit platforms, becuase it still leaves out a number of perfectly valid offsets (e.g. "md 0xffffffffffffff00" doesn't work) Undo the original change and convert the check to simply test if offset is negative. Changes neccessary to alllow access to end of 64-bit address space will be implemented in the follow-up patch. Signed-off-by: Andrey Smirnov Signed-off-by: Sascha Hauer --- fs/fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'fs/fs.c') diff --git a/fs/fs.c b/fs/fs.c index 21f15ec09a..263707c8ff 100644 --- a/fs/fs.c +++ b/fs/fs.c @@ -420,7 +420,7 @@ loff_t lseek(int fildes, loff_t offset, int whence) case SEEK_SET: if (f->size != FILE_SIZE_STREAM && offset > f->size) goto out; - if (IS_ERR_VALUE(offset)) + if (offset < 0) goto out; pos = offset; break; -- cgit v1.2.3