From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755276AbaCHBXd (ORCPT ); Fri, 7 Mar 2014 20:23:33 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:46461 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754177AbaCHBH1 (ORCPT ); Fri, 7 Mar 2014 20:07:27 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miklos Szeredi , Ben Hutchings , Rui Xiang Subject: [PATCH 3.4 55/99] fuse: readdir: check for slash in names Date: Fri, 7 Mar 2014 17:07:51 -0800 Message-Id: <20140308010613.369058150@linuxfoundation.org> X-Mailer: git-send-email 1.9.0 In-Reply-To: <20140308010611.468206150@linuxfoundation.org> References: <20140308010611.468206150@linuxfoundation.org> User-Agent: quilt/0.61-1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Miklos Szeredi commit efeb9e60d48f7778fdcad4a0f3ad9ea9b19e5dfd upstream. Userspace can add names containing a slash character to the directory listing. Don't allow this as it could cause all sorts of trouble. Signed-off-by: Miklos Szeredi [bwh: Backported to 3.2: drop changes to parse_dirplusfile() which we don't have] Signed-off-by: Ben Hutchings Cc: Rui Xiang Signed-off-by: Greg Kroah-Hartman --- fs/fuse/dir.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -1103,6 +1103,8 @@ static int parse_dirfile(char *buf, size return -EIO; if (reclen > nbytes) break; + if (memchr(dirent->name, '/', dirent->namelen) != NULL) + return -EIO; over = filldir(dstbuf, dirent->name, dirent->namelen, file->f_pos, dirent->ino, dirent->type);