54 lines
1.5 KiB
Diff
54 lines
1.5 KiB
Diff
|
From 7cb35119d067191ce9ebc380a599db0b03cbd9d9 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Miklos Szeredi <mszeredi@redhat.com>
|
||
|
|
Date: Thu, 1 Sep 2016 11:12:00 +0200
|
||
|
|
Subject: [PATCH] ovl: listxattr: use strnlen()
|
||
|
|
|
||
|
|
Be defensive about what underlying fs provides us in the returned xattr
|
||
|
|
list buffer. If it's not properly null terminated, bail out with a warning
|
||
|
|
insead of BUG.
|
||
|
|
|
||
|
|
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
||
|
|
Cc: <stable@vger.kernel.org>
|
||
|
|
---
|
||
|
|
fs/overlayfs/inode.c | 17 ++++++++++-------
|
||
|
|
1 file changed, 10 insertions(+), 7 deletions(-)
|
||
|
|
|
||
|
|
--- a/fs/overlayfs/inode.c
|
||
|
|
+++ b/fs/overlayfs/inode.c
|
||
|
|
@@ -277,7 +277,8 @@ ssize_t ovl_listxattr(struct dentry *den
|
||
|
|
struct path realpath;
|
||
|
|
enum ovl_path_type type = ovl_path_real(dentry, &realpath);
|
||
|
|
ssize_t res;
|
||
|
|
- int off;
|
||
|
|
+ size_t len;
|
||
|
|
+ char *s;
|
||
|
|
|
||
|
|
res = vfs_listxattr(realpath.dentry, list, size);
|
||
|
|
if (res <= 0 || size == 0)
|
||
|
|
@@ -287,17 +288,19 @@ ssize_t ovl_listxattr(struct dentry *den
|
||
|
|
return res;
|
||
|
|
|
||
|
|
/* filter out private xattrs */
|
||
|
|
- for (off = 0; off < res;) {
|
||
|
|
- char *s = list + off;
|
||
|
|
- size_t slen = strlen(s) + 1;
|
||
|
|
+ for (s = list, len = res; len;) {
|
||
|
|
+ size_t slen = strnlen(s, len) + 1;
|
||
|
|
|
||
|
|
- BUG_ON(off + slen > res);
|
||
|
|
+ /* underlying fs providing us with an broken xattr list? */
|
||
|
|
+ if (WARN_ON(slen > len))
|
||
|
|
+ return -EIO;
|
||
|
|
|
||
|
|
+ len -= slen;
|
||
|
|
if (ovl_is_private_xattr(s)) {
|
||
|
|
res -= slen;
|
||
|
|
- memmove(s, s + slen, res - off);
|
||
|
|
+ memmove(s, s + slen, len);
|
||
|
|
} else {
|
||
|
|
- off += slen;
|
||
|
|
+ s += slen;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|