xfs: clear kernel only flags in XFS_IOC_ATTRMULTI_BY_HANDLE
commit5.4-rM2-2.2.x-imx-squashed953aa9d136
upstream. Don't allow passing arbitrary flags as they change behavior including memory allocation that the call stack is not prepared for. Fixes:ddbca70cc4
("xfs: allocate xattr buffer on demand") Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
7906e29efa
commit
0d70361dec
|
@ -26,7 +26,7 @@ struct xfs_attr_list_context;
|
||||||
*========================================================================*/
|
*========================================================================*/
|
||||||
|
|
||||||
|
|
||||||
#define ATTR_DONTFOLLOW 0x0001 /* -- unused, from IRIX -- */
|
#define ATTR_DONTFOLLOW 0x0001 /* -- ignored, from IRIX -- */
|
||||||
#define ATTR_ROOT 0x0002 /* use attrs in root (trusted) namespace */
|
#define ATTR_ROOT 0x0002 /* use attrs in root (trusted) namespace */
|
||||||
#define ATTR_TRUST 0x0004 /* -- unused, from IRIX -- */
|
#define ATTR_TRUST 0x0004 /* -- unused, from IRIX -- */
|
||||||
#define ATTR_SECURE 0x0008 /* use attrs in security namespace */
|
#define ATTR_SECURE 0x0008 /* use attrs in security namespace */
|
||||||
|
@ -37,7 +37,10 @@ struct xfs_attr_list_context;
|
||||||
#define ATTR_KERNOVAL 0x2000 /* [kernel] get attr size only, not value */
|
#define ATTR_KERNOVAL 0x2000 /* [kernel] get attr size only, not value */
|
||||||
|
|
||||||
#define ATTR_INCOMPLETE 0x4000 /* [kernel] return INCOMPLETE attr keys */
|
#define ATTR_INCOMPLETE 0x4000 /* [kernel] return INCOMPLETE attr keys */
|
||||||
#define ATTR_ALLOC 0x8000 /* allocate xattr buffer on demand */
|
#define ATTR_ALLOC 0x8000 /* [kernel] allocate xattr buffer on demand */
|
||||||
|
|
||||||
|
#define ATTR_KERNEL_FLAGS \
|
||||||
|
(ATTR_KERNOTIME | ATTR_KERNOVAL | ATTR_INCOMPLETE | ATTR_ALLOC)
|
||||||
|
|
||||||
#define XFS_ATTR_FLAGS \
|
#define XFS_ATTR_FLAGS \
|
||||||
{ ATTR_DONTFOLLOW, "DONTFOLLOW" }, \
|
{ ATTR_DONTFOLLOW, "DONTFOLLOW" }, \
|
||||||
|
|
|
@ -536,6 +536,8 @@ xfs_attrmulti_by_handle(
|
||||||
|
|
||||||
error = 0;
|
error = 0;
|
||||||
for (i = 0; i < am_hreq.opcount; i++) {
|
for (i = 0; i < am_hreq.opcount; i++) {
|
||||||
|
ops[i].am_flags &= ~ATTR_KERNEL_FLAGS;
|
||||||
|
|
||||||
ops[i].am_error = strncpy_from_user((char *)attr_name,
|
ops[i].am_error = strncpy_from_user((char *)attr_name,
|
||||||
ops[i].am_attrname, MAXNAMELEN);
|
ops[i].am_attrname, MAXNAMELEN);
|
||||||
if (ops[i].am_error == 0 || ops[i].am_error == MAXNAMELEN)
|
if (ops[i].am_error == 0 || ops[i].am_error == MAXNAMELEN)
|
||||||
|
|
|
@ -450,6 +450,8 @@ xfs_compat_attrmulti_by_handle(
|
||||||
|
|
||||||
error = 0;
|
error = 0;
|
||||||
for (i = 0; i < am_hreq.opcount; i++) {
|
for (i = 0; i < am_hreq.opcount; i++) {
|
||||||
|
ops[i].am_flags &= ~ATTR_KERNEL_FLAGS;
|
||||||
|
|
||||||
ops[i].am_error = strncpy_from_user((char *)attr_name,
|
ops[i].am_error = strncpy_from_user((char *)attr_name,
|
||||||
compat_ptr(ops[i].am_attrname),
|
compat_ptr(ops[i].am_attrname),
|
||||||
MAXNAMELEN);
|
MAXNAMELEN);
|
||||||
|
|
Loading…
Reference in New Issue