From: Tariq Saeed <tariq.x.saeed@oracle.com>
Date: Tue, 21 Jan 2014 23:48:38 +0000 (-0800)
Subject: ocfs2: punch hole should return EINVAL if the length argument in ioctl is negative
X-Git-Tag: v3.14-rc1~134^2~97
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a2a3b39824e152ecf0e7357ccc7b9d6fd4b9fe7e;p=platform%2Fkernel%2Flinux-exynos.git

ocfs2: punch hole should return EINVAL if the length argument in ioctl is negative

An unreserve space ioctl OCFS2_IOC_UNRESVSP/64 should reject a negative
length.

Orabug:14789508

Signed-off-by: Tariq Saseed <tariq.x.saeed@oracle.com>
Signed-off-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 6fff128..f42eece 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1869,7 +1869,8 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
 	}
 	size = sr->l_start + sr->l_len;
 
-	if (cmd == OCFS2_IOC_RESVSP || cmd == OCFS2_IOC_RESVSP64) {
+	if (cmd == OCFS2_IOC_RESVSP || cmd == OCFS2_IOC_RESVSP64 ||
+	    cmd == OCFS2_IOC_UNRESVSP || cmd == OCFS2_IOC_UNRESVSP64) {
 		if (sr->l_len <= 0) {
 			ret = -EINVAL;
 			goto out_inode_unlock;