Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1505724

[PATCH 4.4 04/25] fuse: listxattr: verify xattr list

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@redhat.com>

commit cb3ae6d25a5471be62bfe6ac1fccc0e91edeaba0 upstream.

Make sure userspace filesystem is returning a well formed list of xattr
names (zero or more nonzero length, null terminated strings).

[Michael Theall: only verify in the nonzero size case]

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/fuse/dir.c |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1797,6 +1797,23 @@ static ssize_t fuse_getxattr(struct dent
 	return ret;
 }
 
+static int fuse_verify_xattr_list(char *list, size_t size)
+{
+	size_t origsize = size;
+
+	while (size) {
+		size_t thislen = strnlen(list, size);
+
+		if (!thislen || thislen == size)
+			return -EIO;
+
+		size -= thislen + 1;
+		list += thislen + 1;
+	}
+
+	return origsize;
+}
+
 static ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
 {
 	struct inode *inode = d_inode(entry);
@@ -1832,6 +1849,8 @@ static ssize_t fuse_listxattr(struct den
 	ret = fuse_simple_request(fc, &args);
 	if (!ret && !size)
 		ret = outarg.size;
+	if (ret > 0 && size)
+		ret = fuse_verify_xattr_list(list, ret);
 	if (ret == -ENOSYS) {
 		fc->no_listxattr = 1;
 		ret = -EOPNOTSUPP;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/25] 4.4.27-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 06/25] fuse: fix killing s[ug]id in setattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 09/25] ASoC: Intel: Atom: add a missing star in a memcpy call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 14/25] scsi: arcmsr: Simplify user_len checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 01/25] serial: 8250_dw: Check the data->pclk when get apb_pclk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 11/25] reiserfs: switch to generic_{get,set,remove}xattr() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 25/25] cfq: fix starvation of asynchronous writes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 18/25] ext4: fix memory leak in ext4_insert_range() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 12/25] async_pq_val: fix DMA memory leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 13/25] scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 16/25] ext4: enforce online defrag restriction for encrypted files Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 03/25] drivers: base: dma-mapping: page align the size when unmap_kernel_range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 02/25] btrfs: assign error values to the correct bio structs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:20 +0200
  [PATCH 4.4 04/25] fuse: listxattr: verify xattr list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:50 +0200
  [PATCH 4.4 24/25] vfs: move permission checking into notify_change() for utimes(NULL) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:50 +0200
  [PATCH 4.4 17/25] ext4: reinforce check of i_dtime when clearing high fields of uid and gid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:50 +0200
  [PATCH 4.4 10/25] reiserfs: Unlock superblock before calling reiserfs_quota_on_mount() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:50 +0200
  [PATCH 4.4 15/25] scsi: ibmvfc: Fix I/O hang when port is not mapped Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:50 +0200
  [PATCH 4.4 20/25] ext4: release bh in make_indexed_dir Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:50 +0200
  [PATCH 4.4 19/25] ext4: allow DAX writeback for hole punch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:50 +0200
  [PATCH 4.4 22/25] crypto: vmx - Fix memory corruption caused by p8_ghash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:50 +0200
  Re: [PATCH 4.4 00/25] 4.4.27-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-10-21 17:50 +0200
  Re: [PATCH 4.4 00/25] 4.4.27-stable review Guenter Roeck <linux@roeck-us.net> - 2016-10-21 21:20 +0200

csiph-web