mirror of
https://github.com/torvalds/linux
synced 2024-10-15 15:59:15 +00:00
xfs: revert commit 8954c44ff4
The name passed into __xfs_xattr_put_listent is exactly namelen bytes
long and not null-terminated. Passing namelen+1 to the strscpy function
strscpy(offset, (char *)name, namelen + 1);
is therefore wrong. Go back to the old code, which works fine because
strncpy won't find a null in @name and stops after namelen bytes. It
really could be a memcpy call, but it worked for years.
Reported-by: syzbot+898115bc6d7140437215@syzkaller.appspotmail.com
Fixes: 8954c44ff4
("xfs: use strscpy() to instead of strncpy()")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
This commit is contained in:
parent
2ee8333529
commit
dd07bb8b6b
|
@ -212,7 +212,9 @@ __xfs_xattr_put_listent(
|
|||
offset = context->buffer + context->count;
|
||||
memcpy(offset, prefix, prefix_len);
|
||||
offset += prefix_len;
|
||||
strscpy(offset, (char *)name, namelen + 1); /* real name */
|
||||
strncpy(offset, (char *)name, namelen); /* real name */
|
||||
offset += namelen;
|
||||
*offset = '\0';
|
||||
|
||||
compute_size:
|
||||
context->count += prefix_len + namelen + 1;
|
||||
|
|
Loading…
Reference in a new issue