Attachment 859769 Details for Bug 1050964 – Patch to fix prepend_name() with *buflen < 0

[patch] Patch to fix prepend_name() with *buflen < 0

0001-fs-fix-d_path-with-zero-length-input-buffer.patch (text/plain), 1.39 KB, created by Denys Vlasenko on 2014-02-05 17:39:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Denys Vlasenko

Created: 2014-02-05 17:39:25 UTC

Size: 1.39 KB

patch

obsolete

>From fc3ba1453a0292aceefacd0df11d89f45598f38b Mon Sep 17 00:00:00 2001
>From: Denys Vlasenko <dvlasenk@redhat.com>
>To: linux-kernel@vger.kernel.org
>Date: Wed, 5 Feb 2014 18:29:22 +0100
>Subject: [PATCH] fs: fix d_path() with zero-length input buffer
>
>In prepend_name(), *buflen < dlen + 1 comparison is buggy
>because dlen has unsigned data type, and we can reach this location
>with *buflen == -1.
>
>The fix casts dlen to int.
>
>Bug reports:
>https://bugzilla.redhat.com/show_bug.cgi?id=1050964
>https://bugzilla.redhat.com/show_bug.cgi?id=1060384
>
>Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
>Cc: Al Viro <viro@zeniv.linux.org.uk>
>Cc: Oleg Nesterov <oleg@redhat.com>
>Cc: Jan Kratochvil <jan.kratochvil@redhat.com>
>Cc: Amerigo Wang <amwang@redhat.com>
>Cc: "Jonathan M. Foote" <jmfoote@cert.org>
>Cc: Roland McGrath <roland@hack.frob.com>
>Cc: Pedro Alves <palves@redhat.com>
>Cc: Fengguang Wu <fengguang.wu@intel.com>
>Cc: Stephen Rothwell <sfr@canb.auug.org.au>
>---
> fs/dcache.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/fs/dcache.c b/fs/dcache.c
>index 265e0ce..40ded0c 100644
>--- a/fs/dcache.c
>+++ b/fs/dcache.c
>@@ -2833,7 +2833,7 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name)
> 	u32 dlen = ACCESS_ONCE(name->len);
> 	char *p;
> 
>-	if (*buflen < dlen + 1)
>+	if (*buflen < (int)dlen + 1)
> 		return -ENAMETOOLONG;
> 	*buflen -= dlen + 1;
> 	p = *buffer -= dlen + 1;
>-- 
>1.8.1.4
>

Actions: View | Diff

Attachments on bug 1050964: 851700 | 852718 | 853096 | 859160 | 859769