2012-02-03 14:59:19

by Xi Wang

Subject: [PATCH RESEND] ceph: avoid panic with mismatched symlink sizes in fill_inode()

Return -EINVAL rather than panic if iinfo->symlink_len and
inode->i_size do not match.

Also use kstrndup rather than kmalloc/memcpy.

Signed-off-by: Xi Wang <[email protected]>
---
fs/ceph/inode.c | 11 ++++++-----
1 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 2c48937..6c0205d 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -677,18 +677,19 @@ static int fill_inode(struct inode *inode,
case S_IFLNK:
inode->i_op = &ceph_symlink_iops;
if (!ci->i_symlink) {
- int symlen = iinfo->symlink_len;
+ u32 symlen = iinfo->symlink_len;
char *sym;

- BUG_ON(symlen != inode->i_size);
spin_unlock(&ci->i_ceph_lock);

+ err = -EINVAL;
+ if (symlen != inode->i_size)
+ goto out;
+
err = -ENOMEM;
- sym = kmalloc(symlen+1, GFP_NOFS);
+ sym = kstrndup(iinfo->symlink, symlen, GFP_NOFS);
if (!sym)
goto out;
- memcpy(sym, iinfo->symlink, symlen);
- sym[symlen] = 0;

spin_lock(&ci->i_ceph_lock);
if (!ci->i_symlink)
--
1.7.5.4

2012-02-03 20:24:39

by Alex Elder

Subject: Re: [PATCH RESEND] ceph: avoid panic with mismatched symlink sizes in fill_inode()

On Fri, 2012-02-03 at 09:55 -0500, Xi Wang wrote:
> Return -EINVAL rather than panic if iinfo->symlink_len and
> inode->i_size do not match.
>
> Also use kstrndup rather than kmalloc/memcpy.
>
> Signed-off-by: Xi Wang <[email protected]>

Looks good, though it might good to at least call
WARN_ON(). What do you think?

I will commit this (either with or without the
WARN_ON()).

Reviewed-by: Alex Elder <[email protected]>

2012-02-03 20:49:13

by Xi Wang

Subject: Re: [PATCH RESEND] ceph: avoid panic with mismatched symlink sizes in fill_inode()

On Feb 3, 2012, at 3:24 PM, Alex Elder wrote:
> Looks good, though it might good to at least call
> WARN_ON(). What do you think?

Sounds good to me. I will send a v2. Thanks.

- xi

2012-02-03 20:58:21

by Xi Wang

Subject: [PATCH v2] ceph: avoid panic with mismatched symlink sizes in fill_inode()

Return -EINVAL rather than panic if iinfo->symlink_len and inode->i_size
do not match.

Also use kstrndup rather than kmalloc/memcpy.

Signed-off-by: Xi Wang <[email protected]>
---
fs/ceph/inode.c | 11 ++++++-----
1 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 2c48937..9fff9f3 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -677,18 +677,19 @@ static int fill_inode(struct inode *inode,
case S_IFLNK:
inode->i_op = &ceph_symlink_iops;
if (!ci->i_symlink) {
- int symlen = iinfo->symlink_len;
+ u32 symlen = iinfo->symlink_len;
char *sym;

- BUG_ON(symlen != inode->i_size);
spin_unlock(&ci->i_ceph_lock);

+ err = -EINVAL;
+ if (WARN_ON(symlen != inode->i_size))
+ goto out;
+
err = -ENOMEM;
- sym = kmalloc(symlen+1, GFP_NOFS);
+ sym = kstrndup(iinfo->symlink, symlen, GFP_NOFS);
if (!sym)
goto out;
- memcpy(sym, iinfo->symlink, symlen);
- sym[symlen] = 0;

spin_lock(&ci->i_ceph_lock);
if (!ci->i_symlink)
--
1.7.5.4

2012-02-03 21:04:37

by Alex Elder

Subject: Re: [PATCH RESEND] ceph: avoid panic with mismatched symlink sizes in fill_inode()

On Fri, 2012-02-03 at 15:49 -0500, Xi Wang wrote:
> On Feb 3, 2012, at 3:24 PM, Alex Elder wrote:
> > Looks good, though it might good to at least call
> > WARN_ON(). What do you think?
>
> Sounds good to me. I will send a v2. Thanks.

No need. I can do it for you. -Alex

> - xi
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html