From: Chris Snook Add SEEK_MAX and use it to validate lseek arguments from userspace. Signed-off-by: Chris Snook Acked-by: David Howells Signed-off-by: Andrew Morton --- fs/read_write.c | 4 ++-- include/linux/fs.h | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff -puN fs/read_write.c~use-use-seek_max-to-validate-user-lseek-arguments fs/read_write.c --- a/fs/read_write.c~use-use-seek_max-to-validate-user-lseek-arguments +++ a/fs/read_write.c @@ -139,7 +139,7 @@ asmlinkage off_t sys_lseek(unsigned int goto bad; retval = -EINVAL; - if (origin <= 2) { + if (origin <= SEEK_MAX) { loff_t res = vfs_llseek(file, offset, origin); retval = res; if (res != (loff_t)retval) @@ -166,7 +166,7 @@ asmlinkage long sys_llseek(unsigned int goto bad; retval = -EINVAL; - if (origin > 2) + if (origin > SEEK_MAX) goto out_putf; offset = vfs_llseek(file, ((loff_t) offset_high << 32) | offset_low, diff -puN include/linux/fs.h~use-use-seek_max-to-validate-user-lseek-arguments include/linux/fs.h --- a/include/linux/fs.h~use-use-seek_max-to-validate-user-lseek-arguments +++ a/include/linux/fs.h @@ -30,6 +30,7 @@ #define SEEK_SET 0 /* seek relative to beginning of file */ #define SEEK_CUR 1 /* seek relative to current file position */ #define SEEK_END 2 /* seek relative to end of file */ +#define SEEK_MAX SEEK_END /* And dynamically-tunable limits and defaults: */ struct files_stat_struct { _