diff options
| author | Jason A. Donenfeld <Jason@zx2c4.com> | 2022-06-25 13:01:08 +0200 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2022-06-25 19:52:49 -0500 |
| commit | 067baa9a37b32b95fdeabccde4b0cb6a2cf95f96 (patch) | |
| tree | b6b9a06e704c3cf8479dd464a6facc2d18995cf5 /fs | |
| parent | b5e5f9dfc915ff05b41dff56181e1dae101712bd (diff) | |
| download | lwn-067baa9a37b32b95fdeabccde4b0cb6a2cf95f96.tar.gz lwn-067baa9a37b32b95fdeabccde4b0cb6a2cf95f96.zip | |
ksmbd: use vfs_llseek instead of dereferencing NULL
By not checking whether llseek is NULL, this might jump to NULL. Also,
it doesn't check FMODE_LSEEK. Fix this by using vfs_llseek(), which
always does the right thing.
Fixes: f44158485826 ("cifsd: add file operations")
Cc: stable@vger.kernel.org
Cc: linux-cifs@vger.kernel.org
Cc: Ronnie Sahlberg <lsahlber@redhat.com>
Cc: Hyunchul Lee <hyc.lee@gmail.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ksmbd/vfs.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/ksmbd/vfs.c b/fs/ksmbd/vfs.c index f194bf764f9f..5d185564aef6 100644 --- a/fs/ksmbd/vfs.c +++ b/fs/ksmbd/vfs.c @@ -1048,7 +1048,7 @@ int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length, *out_count = 0; end = start + length; while (start < end && *out_count < in_count) { - extent_start = f->f_op->llseek(f, start, SEEK_DATA); + extent_start = vfs_llseek(f, start, SEEK_DATA); if (extent_start < 0) { if (extent_start != -ENXIO) ret = (int)extent_start; @@ -1058,7 +1058,7 @@ int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length, if (extent_start >= end) break; - extent_end = f->f_op->llseek(f, extent_start, SEEK_HOLE); + extent_end = vfs_llseek(f, extent_start, SEEK_HOLE); if (extent_end < 0) { if (extent_end != -ENXIO) ret = (int)extent_end; |