summaryrefslogtreecommitdiff
path: root/fs/orangefs/xattr.c
diff options
context:
space:
mode:
authorMartin Brandenburg <martin@omnibond.com>2016-03-16 21:01:43 +0300
committerMike Marshall <hubcap@omnibond.com>2016-03-17 21:33:47 +0300
commit02a5cc537dfa222583b6b6c17451a67816fce9f5 (patch)
tree56e4fc6a8a908348bcf35c767915fd9e886ca1c8 /fs/orangefs/xattr.c
parent5e06664f29c92c8e6b007cdec1f3abf197bc1961 (diff)
downloadlinux-02a5cc537dfa222583b6b6c17451a67816fce9f5.tar.xz
orangefs: sanitize listxattr and return EIO on impossible values
Signed-off-by: Martin Brandenburg <martin@omnibond.com> Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Diffstat (limited to 'fs/orangefs/xattr.c')
-rw-r--r--fs/orangefs/xattr.c10
1 files changed, 10 insertions, 0 deletions
diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
index 75a7dde8cc5f..ef5da7538cd5 100644
--- a/fs/orangefs/xattr.c
+++ b/fs/orangefs/xattr.c
@@ -394,6 +394,7 @@ try_again:
gossip_err("%s: impossible value for returned_count:%d:\n",
__func__,
returned_count);
+ ret = -EIO;
goto done;
}
@@ -401,6 +402,15 @@ try_again:
* Check to see how much can be fit in the buffer. Fit only whole keys.
*/
for (i = 0; i < returned_count; i++) {
+ if (new_op->downcall.resp.listxattr.lengths[i] < 0 ||
+ new_op->downcall.resp.listxattr.lengths[i] >
+ ORANGEFS_MAX_XATTR_NAMELEN) {
+ gossip_err("%s: impossible value for lengths[%d]\n",
+ __func__,
+ new_op->downcall.resp.listxattr.lengths[i]);
+ ret = -EIO;
+ goto done;
+ }
if (total + new_op->downcall.resp.listxattr.lengths[i] > size)
goto done;