diff options
| -rw-r--r-- | fs/xfs/xfs_ioctl.c | 23 | ||||
| -rw-r--r-- | fs/xfs/xfs_ioctl32.c | 11 |
2 files changed, 12 insertions, 22 deletions
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c index f1f7f1aec85d..c88ed3e58f82 100644 --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c @@ -361,6 +361,18 @@ xfs_ioc_attr_list( struct xfs_attrlist *alist; int error; + if (bufsize < sizeof(struct xfs_attrlist) || + bufsize > XFS_XATTR_LIST_MAX) + return -EINVAL; + + /* + * Reject flags, only allow namespaces. + */ + if (flags & ~(ATTR_ROOT | ATTR_SECURE)) + return -EINVAL; + if (flags == (ATTR_ROOT | ATTR_SECURE)) + return -EINVAL; + /* * Validate the cursor. */ @@ -415,17 +427,6 @@ xfs_attrlist_by_handle( return -EPERM; if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t))) return -EFAULT; - if (al_hreq.buflen < sizeof(struct xfs_attrlist) || - al_hreq.buflen > XFS_XATTR_LIST_MAX) - return -EINVAL; - - /* - * Reject flags, only allow namespaces. - */ - if (al_hreq.flags & ~(ATTR_ROOT | ATTR_SECURE)) - return -EINVAL; - if (al_hreq.flags == (ATTR_ROOT | ATTR_SECURE)) - return -EINVAL; dentry = xfs_handlereq_to_dentry(parfilp, &al_hreq.hreq); if (IS_ERR(dentry)) diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c index 10ea0222954c..840d17951407 100644 --- a/fs/xfs/xfs_ioctl32.c +++ b/fs/xfs/xfs_ioctl32.c @@ -366,17 +366,6 @@ xfs_compat_attrlist_by_handle( if (copy_from_user(&al_hreq, arg, sizeof(compat_xfs_fsop_attrlist_handlereq_t))) return -EFAULT; - if (al_hreq.buflen < sizeof(struct xfs_attrlist) || - al_hreq.buflen > XFS_XATTR_LIST_MAX) - return -EINVAL; - - /* - * Reject flags, only allow namespaces. - */ - if (al_hreq.flags & ~(ATTR_ROOT | ATTR_SECURE)) - return -EINVAL; - if (al_hreq.flags == (ATTR_ROOT | ATTR_SECURE)) - return -EINVAL; dentry = xfs_compat_handlereq_to_dentry(parfilp, &al_hreq.hreq); if (IS_ERR(dentry)) |