lkml.org 
[lkml]   [2009]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 66/85] eCryptfs: check readlink result was not an error before using it
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------
    From: Duane Griffin <duaneg@dghda.com>

    commit a17d5232de7b53d34229de79ec22f4bb04adb7e4 upstream.

    The result from readlink is being used to index into the link name
    buffer without checking whether it is a valid length. If readlink
    returns an error this will fault or cause memory corruption.

    Cc: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
    Cc: Dustin Kirkland <kirkland@canonical.com>
    Cc: ecryptfs-devel@lists.launchpad.net
    Signed-off-by: Duane Griffin <duaneg@dghda.com>
    Acked-by: Michael Halcrow <mhalcrow@us.ibm.com>
    Acked-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/ecryptfs/inode.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)
    --- a/fs/ecryptfs/inode.c
    +++ b/fs/ecryptfs/inode.c
    @@ -673,10 +673,11 @@ static void *ecryptfs_follow_link(struct
    ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ "
    "dentry->d_name.name = [%s]\n", dentry->d_name.name);
    rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
    - buf[rc] = '\0';
    set_fs(old_fs);
    if (rc < 0)
    goto out_free;
    + else
    + buf[rc] = '\0';
    rc = 0;
    nd_set_link(nd, buf);
    goto out;


    \
     
     \ /
      Last update: 2009-01-15 23:43    [W:0.144 / U:2.208 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site