diff options
| -rw-r--r-- | fs/fuse/dev_uring.c | 22 |
1 files changed, 17 insertions, 5 deletions
diff --git a/fs/fuse/dev_uring.c b/fs/fuse/dev_uring.c index 1d37a2ee5532..42627838cfa6 100644 --- a/fs/fuse/dev_uring.c +++ b/fs/fuse/dev_uring.c @@ -590,6 +590,18 @@ static __always_inline int copy_header_to_ring(void __user *ring, return 0; } +static __always_inline int copy_header_from_ring(void *header, + const void __user *ring, + size_t header_size) +{ + if (copy_from_user(header, ring, header_size)) { + pr_info_ratelimited("Copying header from ring failed.\n"); + return -EFAULT; + } + + return 0; +} + static int fuse_uring_copy_from_ring(struct fuse_ring *ring, struct fuse_req *req, struct fuse_ring_ent *ent) @@ -600,10 +612,10 @@ static int fuse_uring_copy_from_ring(struct fuse_ring *ring, int err; struct fuse_uring_ent_in_out ring_in_out; - err = copy_from_user(&ring_in_out, &ent->headers->ring_ent_in_out, - sizeof(ring_in_out)); + err = copy_header_from_ring(&ring_in_out, &ent->headers->ring_ent_in_out, + sizeof(ring_in_out)); if (err) - return -EFAULT; + return err; err = import_ubuf(ITER_SOURCE, ent->payload, ring->max_payload_sz, &iter); @@ -810,8 +822,8 @@ static void fuse_uring_commit(struct fuse_ring_ent *ent, struct fuse_req *req, struct fuse_ring *ring = ent->queue->ring; ssize_t err = -EFAULT; - if (copy_from_user(&req->out.h, &ent->headers->in_out, - sizeof(req->out.h))) + if (copy_header_from_ring(&req->out.h, &ent->headers->in_out, + sizeof(req->out.h))) goto out; err = fuse_uring_out_header_has_err(&req->out.h, req); |