target/linux/generic/patches-4.4/051-0006-ovl-listxattr-use-strnlen.patch

   1 From 7cb35119d067191ce9ebc380a599db0b03cbd9d9 Mon Sep 17 00:00:00 2001
   2 From: Miklos Szeredi <mszeredi@redhat.com>
   3 Date: Thu, 1 Sep 2016 11:12:00 +0200
   4 Subject: [PATCH] ovl: listxattr: use strnlen()
   5
   6 Be defensive about what underlying fs provides us in the returned xattr
   7 list buffer.  If it's not properly null terminated, bail out with a warning
   8 insead of BUG.
   9
  10 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
  11 Cc: <stable@vger.kernel.org>
  12 ---
  13  fs/overlayfs/inode.c | 17 ++++++++++-------
  14  1 file changed, 10 insertions(+), 7 deletions(-)
  15
  16 --- a/fs/overlayfs/inode.c
  17 +++ b/fs/overlayfs/inode.c
  18 @@ -277,7 +277,8 @@ ssize_t ovl_listxattr(struct dentry *den
  19         struct path realpath;
  20         enum ovl_path_type type = ovl_path_real(dentry, &realpath);
  21         ssize_t res;
  22 -       int off;
  23 +       size_t len;
  24 +       char *s;
  25
  26         res = vfs_listxattr(realpath.dentry, list, size);
  27         if (res <= 0 || size == 0)
  28 @@ -287,17 +288,19 @@ ssize_t ovl_listxattr(struct dentry *den
  29                 return res;
  30
  31         /* filter out private xattrs */
  32 -       for (off = 0; off < res;) {
  33 -               char *s = list + off;
  34 -               size_t slen = strlen(s) + 1;
  35 +       for (s = list, len = res; len;) {
  36 +               size_t slen = strnlen(s, len) + 1;
  37
  38 -               BUG_ON(off + slen > res);
  39 +               /* underlying fs providing us with an broken xattr list? */
  40 +               if (WARN_ON(slen > len))
  41 +                       return -EIO;
  42
  43 +               len -= slen;
  44                 if (ovl_is_private_xattr(s)) {
  45                         res -= slen;
  46 -                       memmove(s, s + slen, res - off);
  47 +                       memmove(s, s + slen, len);
  48                 } else {
  49 -                       off += slen;
  50 +                       s += slen;
  51                 }
  52         }
  53