| From 171e73d70a2749ed3facc1bf35c5deafe097cd9e Mon Sep 17 00:00:00 2001 |
| From: Martin Brandenburg <martin@omnibond.com> |
| Date: Tue, 25 Apr 2017 15:37:57 -0400 |
| Subject: [PATCH] orangefs: clean up oversize xattr validation |
| |
| commit e675c5ec51fe2554719a7b6bcdbef0a770f2c19b upstream. |
| |
| Also don't check flags as this has been validated by the VFS already. |
| |
| Fix an off-by-one error in the max size checking. |
| |
| Stop logging just because userspace wants to write attributes which do |
| not fit. |
| |
| This and the previous commit fix xfstests generic/020. |
| |
| Signed-off-by: Martin Brandenburg <martin@omnibond.com> |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Mike Marshall <hubcap@omnibond.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c |
| index 996698a60ca7..4a31a1fe82fb 100644 |
| --- a/fs/orangefs/xattr.c |
| +++ b/fs/orangefs/xattr.c |
| @@ -73,11 +73,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name, |
| "%s: name %s, buffer_size %zd\n", |
| __func__, name, size); |
| |
| - if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) { |
| - gossip_err("Invalid key length (%d)\n", |
| - (int)strlen(name)); |
| + if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) |
| return -EINVAL; |
| - } |
| |
| fsuid = from_kuid(&init_user_ns, current_fsuid()); |
| fsgid = from_kgid(&init_user_ns, current_fsgid()); |
| @@ -169,6 +166,9 @@ static int orangefs_inode_removexattr(struct inode *inode, const char *name, |
| struct orangefs_kernel_op_s *new_op = NULL; |
| int ret = -ENOMEM; |
| |
| + if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) |
| + return -EINVAL; |
| + |
| down_write(&orangefs_inode->xattr_sem); |
| new_op = op_alloc(ORANGEFS_VFS_OP_REMOVEXATTR); |
| if (!new_op) |
| @@ -228,23 +228,13 @@ int orangefs_inode_setxattr(struct inode *inode, const char *name, |
| "%s: name %s, buffer_size %zd\n", |
| __func__, name, size); |
| |
| - if (size >= ORANGEFS_MAX_XATTR_VALUELEN || |
| - flags < 0) { |
| - gossip_err("orangefs_inode_setxattr: bogus values of size(%d), flags(%d)\n", |
| - (int)size, |
| - flags); |
| + if (size > ORANGEFS_MAX_XATTR_VALUELEN) |
| + return -EINVAL; |
| + if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN) |
| return -EINVAL; |
| - } |
| |
| internal_flag = convert_to_internal_xattr_flags(flags); |
| |
| - if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) { |
| - gossip_err |
| - ("orangefs_inode_setxattr: bogus key size (%d)\n", |
| - (int)(strlen(name))); |
| - return -EINVAL; |
| - } |
| - |
| /* This is equivalent to a removexattr */ |
| if (size == 0 && value == NULL) { |
| gossip_debug(GOSSIP_XATTR_DEBUG, |
| -- |
| 2.12.0 |
| |