[lkml]   [2008]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] ufs: ensure fast symlinks are NUL-terminated
    On Tue, Dec 16, 2008 at 10:40:55PM +0300, Evgeniy Dushistov wrote:
    > There is different types of ufs, one used 64 bit for "pointers to
    > blocks", another 32 bit,
    > so sizeof(UFS_I(inode)->i_u1.i_symlink))
    > is not right choice every time,
    > in ufs2 it should be
    > sizeof(UFS_I(inode)->i_u1.u2_i_data) which 2 times bigger,
    > also there is hint for *BSD ufs
    > fs/ufs/ufs_fs.h:
    > __fs32 fs_maxsymlinklen;/* max length of an internal symlink */
    > which may be used if ufs type ufs1 or ufs2

    Hmm, I see. However it looks like ufs1_read_inode and ufs2_read_inode
    both copy the same, ((UFS_NDADDR + UFS_NINDIR) * 4), amount of inline
    symlink data. They also both copy it to ufs_inode_info->i_u1.i_symlink
    (not that that matters, I suppose). Perhaps I'm being obtuse, but it
    looks like inline ufs2 symlinks between 60 and 120 characters long are
    being truncated to 60 characters, no?

    There also doesn't seem to be any validation of (f)s_maxsymlinklen being
    done. Unless I'm mistaken ufs_symlink could end up overwriting random
    memory if it contains a large bogus value.

    Does that all sound correct? If so would you like me to whip up a couple
    of patches to fix it? I'll respin the NUL-termination patch on top of
    those, if so.

    > /Evgeniy


    "I never could learn to drink that blood and call it wine" - Bob Dylan

     \ /
      Last update: 2008-12-17 00:21    [W:0.049 / U:15.516 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site