From: Kevin Jamieson <kevin@kevinjamieson.com>
To: xfs@oss.sgi.com
Subject: dm_get_dirattrs can write past end of user buffer
Date: Sat, 31 Jan 2009 16:12:52 -0800 [thread overview]
Message-ID: <4984E904.3020509@kevinjamieson.com> (raw)
I have observed segfaults with an application that calls dm_get_dirattrs
with the latest DMAPI kernel built from SGI CVS.
The problem appears to be in dm_filldir:
needed = dm_stat_size(namelen + 1);
...
error = -xfs_dm_bulkattr_iget_one(cb->mp, ino, 0,
statp, needed);
...
/*
* On return from bulkstat_one(), stap->_link points
* at the end of the handle in the stat structure.
*/
statp->dt_compname.vd_offset = statp->_link;
statp->dt_compname.vd_length = namelen + 1;
xfs_dm_bulkattr_iget_one() sets statp->_link to needed, so the name ends
up getting written past the space reserved for the name, which can
exceed cb->spaceleft.
The below patch appears to fix the problem.
Index: fs/xfs/dmapi/xfs_dm.c
===================================================================
RCS file: /cvs/linux-2.6-xfs/fs/xfs/dmapi/xfs_dm.c,v
retrieving revision 1.81
diff -u -r1.81 xfs_dm.c
--- fs/xfs/dmapi/xfs_dm.c 28 Oct 2008 05:39:09 -0000 1.81
+++ fs/xfs/dmapi/xfs_dm.c 31 Jan 2009 23:08:07 -0000
@@ -1793,7 +1793,7 @@
memset(statp, 0, dm_stat_size(MAXNAMLEN));
error = -xfs_dm_bulkattr_iget_one(cb->mp, ino, 0,
- statp, needed);
+ statp, DM_STAT_SIZE(*statp, 0));
if (error)
goto out_err;
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
next reply other threads:[~2009-02-01 0:13 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-02-01 0:12 Kevin Jamieson [this message]
2009-02-01 5:09 ` dm_get_dirattrs can write past end of user buffer Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4984E904.3020509@kevinjamieson.com \
--to=kevin@kevinjamieson.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox