From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miklos Szeredi , Ben Hutchings , Rui Xiang Subject: [PATCH 3.4 55/99] fuse: readdir: check for slash in names Date: Fri, 7 Mar 2014 17:07:51 -0800 Message-Id: <20140308010613.369058150@linuxfoundation.org> In-Reply-To: <20140308010611.468206150@linuxfoundation.org> References: <20140308010611.468206150@linuxfoundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: 3.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Miklos Szeredi commit efeb9e60d48f7778fdcad4a0f3ad9ea9b19e5dfd upstream. Userspace can add names containing a slash character to the directory listing. Don't allow this as it could cause all sorts of trouble. Signed-off-by: Miklos Szeredi [bwh: Backported to 3.2: drop changes to parse_dirplusfile() which we don't have] Signed-off-by: Ben Hutchings Cc: Rui Xiang Signed-off-by: Greg Kroah-Hartman --- fs/fuse/dir.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -1103,6 +1103,8 @@ static int parse_dirfile(char *buf, size return -EIO; if (reclen > nbytes) break; + if (memchr(dirent->name, '/', dirent->namelen) != NULL) + return -EIO; over = filldir(dstbuf, dirent->name, dirent->namelen, file->f_pos, dirent->ino, dirent->type);