On Thu, 2008-12-11 at 19:16 +0000, Duane Griffin wrote:
> Ensure link targets are NULL-terminated, even if corrupted on-disk.
>
> Signed-off-by: Duane Griffin <duaneg@xxxxxxxxx>
> ---
> fs/jfs/symlink.c | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/fs/jfs/symlink.c b/fs/jfs/symlink.c
> index 4af1a05..f5f1b5d 100644
> --- a/fs/jfs/symlink.c
> +++ b/fs/jfs/symlink.c
> @@ -18,6 +18,7 @@
>
> #include <linux/fs.h>
> #include <linux/namei.h>
> +#include "jfs_filsys.h"
> #include "jfs_incore.h"
> #include "jfs_inode.h"
> #include "jfs_xattr.h"
> @@ -25,6 +26,7 @@
> static void *jfs_follow_link(struct dentry *dentry, struct nameidata *nd)
> {
> char *s = JFS_IP(dentry->d_inode)->i_inline;
> + s[IDATASIZE - 1] = '\0';
> nd_set_link(nd, s);
> return NULL;
> }
Thanks.
I came up with an alternate patch that I like slightly better. This one
null-terminates the string when the inode is read rather than every time
the link is followed, and at the proper place (i_size). It's not a big
deal, since the symlink will be corrupted either way. What do you think
of this patch?
Signed-off-by: Dave Kleikamp <shaggy@xxxxxxxxxxxxxxxxxx>
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 2103397..b00ee9f 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -59,8 +59,14 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
if (inode->i_size >= IDATASIZE) {
inode->i_op = &page_symlink_inode_operations;
inode->i_mapping->a_ops = &jfs_aops;
- } else
+ } else {
inode->i_op = &jfs_symlink_inode_operations;
+ /*
+ * The inline data should be null-terminated, but
+ * don't let on-disk corruption crash the kernel
+ */
+ JFS_IP(inode)->i_inline[inode->i_size] = '\0';
+ }
} else {
inode->i_op = &jfs_file_inode_operations;
init_special_inode(inode, inode->i_mode, inode->i_rdev);
--
David Kleikamp
IBM Linux Technology Center
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
