aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDuane Griffin <duaneg@dghda.com>2008-12-19 15:47:10 -0500
committerAl Viro <viro@zeniv.linux.org.uk>2008-12-31 18:07:38 -0500
commita17d5232de7b53d34229de79ec22f4bb04adb7e4 (patch)
treed42a96bf5e0806e4a67404709a8fdf0ed4e551c0
parent5cc4a0341a1295ea56b2e62eb70d96d8fdb94ded (diff)
eCryptfs: check readlink result was not an error before using it
The result from readlink is being used to index into the link name buffer without checking whether it is a valid length. If readlink returns an error this will fault or cause memory corruption. Cc: Tyler Hicks <tyhicks@linux.vnet.ibm.com> Cc: Dustin Kirkland <kirkland@canonical.com> Cc: ecryptfs-devel@lists.launchpad.net Signed-off-by: Duane Griffin <duaneg@dghda.com> Acked-by: Michael Halcrow <mhalcrow@us.ibm.com> Acked-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r--fs/ecryptfs/inode.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 89209f00f9c..5e78fc17988 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -673,10 +673,11 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
673 ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ " 673 ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ "
674 "dentry->d_name.name = [%s]\n", dentry->d_name.name); 674 "dentry->d_name.name = [%s]\n", dentry->d_name.name);
675 rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len); 675 rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
676 buf[rc] = '\0';
677 set_fs(old_fs); 676 set_fs(old_fs);
678 if (rc < 0) 677 if (rc < 0)
679 goto out_free; 678 goto out_free;
679 else
680 buf[rc] = '\0';
680 rc = 0; 681 rc = 0;
681 nd_set_link(nd, buf); 682 nd_set_link(nd, buf);
682 goto out; 683 goto out;