summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric Sandeen <sandeen@redhat.com>2017-02-02 08:56:04 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-02-04 09:47:12 +0100
commitd062d90c35f292b3e6ee266746259e2e2950f940 (patch)
tree1c6bb6ee1491d78200b3245593975415e01a3c63
parentd3201a14b36ae6ffb36b6b830e216f0ae4ebc184 (diff)
downloadblackbird-op-linux-d062d90c35f292b3e6ee266746259e2e2950f940.tar.gz
blackbird-op-linux-d062d90c35f292b3e6ee266746259e2e2950f940.zip
xfs: don't wrap ID in xfs_dq_get_next_id
commit 657bdfb7f5e68ca5e2ed009ab473c429b0d6af85 upstream. The GETNEXTQOTA ioctl takes whatever ID is sent in, and looks for the next active quota for an user equal or higher to that ID. But if we are at the maximum ID and then ask for the "next" one, we may wrap back to zero. In this case, userspace may loop forever, because it will start querying again at zero. We'll fix this in userspace as well, but for the kernel, return -ENOENT if we ask for the next quota ID past UINT_MAX so the caller knows to stop. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--fs/xfs/xfs_dquot.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index 7a30b8f11db7..9d06cc30e875 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -710,6 +710,10 @@ xfs_dq_get_next_id(
/* Simple advance */
next_id = *id + 1;
+ /* If we'd wrap past the max ID, stop */
+ if (next_id < *id)
+ return -ENOENT;
+
/* If new ID is within the current chunk, advancing it sufficed */
if (next_id % mp->m_quotainfo->qi_dqperchunk) {
*id = next_id;
OpenPOWER on IntegriCloud