From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:38049 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758727AbcILNHD (ORCPT ); Mon, 12 Sep 2016 09:07:03 -0400 Subject: Patch "ovl: listxattr: use strnlen()" has been added to the 4.7-stable tree To: mszeredi@redhat.com, gregkh@linuxfoundation.org Cc: , From: Date: Mon, 12 Sep 2016 15:06:57 +0200 Message-ID: <1473685617184218@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ovl: listxattr: use strnlen() to the 4.7-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ovl-listxattr-use-strnlen.patch and it can be found in the queue-4.7 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 7cb35119d067191ce9ebc380a599db0b03cbd9d9 Mon Sep 17 00:00:00 2001 From: Miklos Szeredi Date: Thu, 1 Sep 2016 11:12:00 +0200 Subject: ovl: listxattr: use strnlen() From: Miklos Szeredi commit 7cb35119d067191ce9ebc380a599db0b03cbd9d9 upstream. Be defensive about what underlying fs provides us in the returned xattr list buffer. If it's not properly null terminated, bail out with a warning insead of BUG. Signed-off-by: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman --- fs/overlayfs/inode.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) --- a/fs/overlayfs/inode.c +++ b/fs/overlayfs/inode.c @@ -279,24 +279,27 @@ ssize_t ovl_listxattr(struct dentry *den { struct dentry *realdentry = ovl_dentry_real(dentry); ssize_t res; - int off; + size_t len; + char *s; res = vfs_listxattr(realdentry, list, size); if (res <= 0 || size == 0) return res; /* filter out private xattrs */ - for (off = 0; off < res;) { - char *s = list + off; - size_t slen = strlen(s) + 1; + for (s = list, len = res; len;) { + size_t slen = strnlen(s, len) + 1; - BUG_ON(off + slen > res); + /* underlying fs providing us with an broken xattr list? */ + if (WARN_ON(slen > len)) + return -EIO; + len -= slen; if (ovl_is_private_xattr(s)) { res -= slen; - memmove(s, s + slen, res - off); + memmove(s, s + slen, len); } else { - off += slen; + s += slen; } } Patches currently in stable-queue which might be from mszeredi@redhat.com are queue-4.7/ovl-listxattr-use-strnlen.patch queue-4.7/ovl-remove-posix_acl_default-from-workdir.patch queue-4.7/ovl-don-t-copy-up-opaqueness.patch queue-4.7/ovl-proper-cleanup-of-workdir.patch queue-4.7/ovl-fix-workdir-creation.patch