| From 12eb22a5a609421b380c3c6ca887474fb2089b2c Mon Sep 17 00:00:00 2001 |
| From: Ilya Dryomov <idryomov@gmail.com> |
| Date: Wed, 20 Nov 2024 16:43:51 +0100 |
| Subject: ceph: validate snapdirname option length when mounting |
| |
| From: Ilya Dryomov <idryomov@gmail.com> |
| |
| commit 12eb22a5a609421b380c3c6ca887474fb2089b2c upstream. |
| |
| It becomes a path component, so it shouldn't exceed NAME_MAX |
| characters. This was hardened in commit c152737be22b ("ceph: Use |
| strscpy() instead of strcpy() in __get_snap_name()"), but no actual |
| check was put in place. |
| |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Ilya Dryomov <idryomov@gmail.com> |
| Reviewed-by: Alex Markuze <amarkuze@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| fs/ceph/super.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/fs/ceph/super.c |
| +++ b/fs/ceph/super.c |
| @@ -431,6 +431,8 @@ static int ceph_parse_mount_param(struct |
| |
| switch (token) { |
| case Opt_snapdirname: |
| + if (strlen(param->string) > NAME_MAX) |
| + return invalfc(fc, "snapdirname too long"); |
| kfree(fsopt->snapdir_name); |
| fsopt->snapdir_name = param->string; |
| param->string = NULL; |
