From 999ae367a8cb213a42f62e6e82b0272f25ebd982 Mon Sep 17 00:00:00 2001 From: pfg Date: Tue, 6 Feb 2018 22:38:19 +0000 Subject: [PATCH] {ext2|ufs}_readdir: Avoid setting negative ncookies. ncookies cannot be negative or the allocator will fail. This should only happen if a caller is very broken but we can still try to survive the event. We should probably also verify for uio_resid > MAXPHYS but in that case it is not clear that just clipping the ncookies value is an adequate response. MFC after: 2 weeks --- sys/fs/ext2fs/ext2_lookup.c | 5 ++++- sys/ufs/ufs/ufs_vnops.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/sys/fs/ext2fs/ext2_lookup.c b/sys/fs/ext2fs/ext2_lookup.c index bdb033a8d20a..cf6b6ff989b1 100644 --- a/sys/fs/ext2fs/ext2_lookup.c +++ b/sys/fs/ext2fs/ext2_lookup.c @@ -153,7 +153,10 @@ ext2_readdir(struct vop_readdir_args *ap) return (EINVAL); ip = VTOI(vp); if (ap->a_ncookies != NULL) { - ncookies = uio->uio_resid; + if (uio->uio_resid < 0) + ncookies = 0; + else + ncookies = uio->uio_resid; if (uio->uio_offset >= ip->i_size) ncookies = 0; else if (ip->i_size - uio->uio_offset < ncookies) diff --git a/sys/ufs/ufs/ufs_vnops.c b/sys/ufs/ufs/ufs_vnops.c index 479091a9182d..66651e3f71bb 100644 --- a/sys/ufs/ufs/ufs_vnops.c +++ b/sys/ufs/ufs/ufs_vnops.c @@ -2179,7 +2179,10 @@ ufs_readdir(ap) if (ip->i_effnlink == 0) return (0); if (ap->a_ncookies != NULL) { - ncookies = uio->uio_resid; + if (uio->uio_resid < 0) + ncookies = 0; + else + ncookies = uio->uio_resid; if (uio->uio_offset >= ip->i_size) ncookies = 0; else if (ip->i_size - uio->uio_offset < ncookies)