Source kernel commit: 4df28c64e4388ac5fa59cd58f9fd6592aae533a2 All the callers already check the length when allocating the in-kernel xattrs buffers. Signed-off-by: Christoph Hellwig <hch@xxxxxx> Reviewed-by: Dave Chinner <dchinner@xxxxxxxxxx> Reviewed-by: Chandan Rajendra <chandanrlinux@xxxxxxxxx> Reviewed-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx> Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx> Signed-off-by: Christoph Hellwig <hch@xxxxxx> --- db/attrset.c | 18 ++++++++++++++++-- libxfs/xfs_attr.c | 3 --- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/db/attrset.c b/db/attrset.c index d4b812e6..c39782b3 100644 --- a/db/attrset.c +++ b/db/attrset.c @@ -69,6 +69,7 @@ attr_set_f( xfs_inode_t *ip = NULL; char *name, *value, *sp; int c, valuelen = 0, flags = 0; + size_t namelen; if (cur_typ == NULL) { dbprintf(_("no current type\n")); @@ -132,6 +133,12 @@ attr_set_f( return 0; } + namelen = strlen(name); + if (namelen >= MAXNAMELEN) { + dbprintf(_("name too long\n")); + return 0; + } + if (valuelen) { value = (char *)memalign(getpagesize(), valuelen); if (!value) { @@ -150,7 +157,7 @@ attr_set_f( goto out; } - if (libxfs_attr_set(ip, (unsigned char *)name, strlen(name), + if (libxfs_attr_set(ip, (unsigned char *)name, namelen, (unsigned char *)value, valuelen, flags)) { dbprintf(_("failed to set attr %s on inode %llu\n"), name, (unsigned long long)iocur_top->ino); @@ -177,6 +184,7 @@ attr_remove_f( xfs_inode_t *ip = NULL; char *name; int c, flags = 0; + size_t namelen; if (cur_typ == NULL) { dbprintf(_("no current type\n")); @@ -223,6 +231,12 @@ attr_remove_f( return 0; } + namelen = strlen(name); + if (namelen >= MAXNAMELEN) { + dbprintf(_("name too long\n")); + return 0; + } + if (libxfs_iget(mp, NULL, iocur_top->ino, 0, &ip, &xfs_default_ifork_ops)) { dbprintf(_("failed to iget inode %llu\n"), @@ -230,7 +244,7 @@ attr_remove_f( goto out; } - if (libxfs_attr_set(ip, (unsigned char *)name, strlen(name), + if (libxfs_attr_set(ip, (unsigned char *)name, namelen, NULL, 0, flags)) { dbprintf(_("failed to remove attr %s from inode %llu\n"), name, (unsigned long long)iocur_top->ino); diff --git a/libxfs/xfs_attr.c b/libxfs/xfs_attr.c index ee2225a3..ded952da 100644 --- a/libxfs/xfs_attr.c +++ b/libxfs/xfs_attr.c @@ -72,9 +72,6 @@ xfs_attr_args_init( args->flags = flags; args->name = name; args->namelen = namelen; - if (args->namelen >= MAXNAMELEN) - return -EFAULT; /* match IRIX behaviour */ - args->hashval = xfs_da_hashname(args->name, args->namelen); return 0; } -- 2.26.2