Commit 83cb10f0 authored by Eric Paris's avatar Eric Paris

inotify: fix length reporting and size checking

0db501bd introduced a regresion in that it now sends a nul
terminator but the length accounting when checking for space or
reporting to userspace did not take this into account.  This corrects
all of the rounding logic.
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent b962e731
...@@ -154,7 +154,8 @@ static struct fsnotify_event *get_one_event(struct fsnotify_group *group, ...@@ -154,7 +154,8 @@ static struct fsnotify_event *get_one_event(struct fsnotify_group *group,
event = fsnotify_peek_notify_event(group); event = fsnotify_peek_notify_event(group);
event_size += roundup(event->name_len, event_size); if (event->name_len)
event_size += roundup(event->name_len + 1, event_size);
if (event_size > count) if (event_size > count)
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
...@@ -327,8 +328,9 @@ static long inotify_ioctl(struct file *file, unsigned int cmd, ...@@ -327,8 +328,9 @@ static long inotify_ioctl(struct file *file, unsigned int cmd,
list_for_each_entry(holder, &group->notification_list, event_list) { list_for_each_entry(holder, &group->notification_list, event_list) {
event = holder->event; event = holder->event;
send_len += sizeof(struct inotify_event); send_len += sizeof(struct inotify_event);
send_len += roundup(event->name_len, if (event->name_len)
sizeof(struct inotify_event)); send_len += roundup(event->name_len + 1,
sizeof(struct inotify_event));
} }
mutex_unlock(&group->notification_mutex); mutex_unlock(&group->notification_mutex);
ret = put_user(send_len, (int __user *) p); ret = put_user(send_len, (int __user *) p);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment