Commit 5f13e587 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mike Marshall

orangefs: off by ones in xattr size checks

A previous patch which claimed to remove off by ones actually introduced
them.

strlen() returns the length of the string not including the NUL
character.  We are using strcpy() to copy "name" into a buffer which is
ORANGEFS_MAX_XATTR_NAMELEN characters long.  We should make sure to
leave space for the NUL, otherwise we're writing one character beyond
the end of the buffer.

Fixes: e675c5ec ("orangefs: clean up oversize xattr validation")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMike Marshall <hubcap@omnibond.com>
parent ba5e79ea
...@@ -76,7 +76,7 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name, ...@@ -76,7 +76,7 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
if (S_ISLNK(inode->i_mode)) if (S_ISLNK(inode->i_mode))
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN)
return -EINVAL; return -EINVAL;
fsuid = from_kuid(&init_user_ns, current_fsuid()); fsuid = from_kuid(&init_user_ns, current_fsuid());
...@@ -169,7 +169,7 @@ static int orangefs_inode_removexattr(struct inode *inode, const char *name, ...@@ -169,7 +169,7 @@ static int orangefs_inode_removexattr(struct inode *inode, const char *name,
struct orangefs_kernel_op_s *new_op = NULL; struct orangefs_kernel_op_s *new_op = NULL;
int ret = -ENOMEM; int ret = -ENOMEM;
if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN)
return -EINVAL; return -EINVAL;
down_write(&orangefs_inode->xattr_sem); down_write(&orangefs_inode->xattr_sem);
...@@ -233,7 +233,7 @@ int orangefs_inode_setxattr(struct inode *inode, const char *name, ...@@ -233,7 +233,7 @@ int orangefs_inode_setxattr(struct inode *inode, const char *name,
if (size > ORANGEFS_MAX_XATTR_VALUELEN) if (size > ORANGEFS_MAX_XATTR_VALUELEN)
return -EINVAL; return -EINVAL;
if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN)
return -EINVAL; return -EINVAL;
internal_flag = convert_to_internal_xattr_flags(flags); internal_flag = convert_to_internal_xattr_flags(flags);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment