ROMFS: romfs_lookup() shouldn't be doing a partial name comparison

romfs_lookup() should be using a routine akin to strcmp() on the backing store,
rather than one akin to strncmp().  If it uses the latter, it's liable to match
/bin/shutdown when looking up /bin/sh.

Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Michal Simek <monstr@monstr.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 2 insertions, 2 deletions

diff --git a/fs/romfs/super.c b/fs/romfs/super.c
index 10ca7d984a8..c53b5ef8a02 100644
--- a/fs/romfs/super.c
+++ b/fs/romfs/super.c
@@ -240,8 +240,8 @@ static struct dentry *romfs_lookup(struct inode *dir, struct dentry *dentry,
                         goto error;
 
                 /* try to match the first 16 bytes of name */
-                ret = romfs_dev_strncmp(dir->i_sb, offset + ROMFH_SIZE, name,
-                                        len);
+                ret = romfs_dev_strcmp(dir->i_sb, offset + ROMFH_SIZE, name,
+                                       len);
                 if (ret < 0)
                         goto error;
                 if (ret == 1)