raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

Merge tag 'for-linus-6.18-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux

Browse Source 
Pull orangefs updates from Mike Marshall:
 "Two cleanups and a bug fix:

   - Remove unused type in macro fill_default_sys_attrs (Zhen Ni)

   - Replace kzalloc + copy_from_user with memdup_user_nul (Thorsten Blum)

   - Fix xattr related buffer overflow...

     A message was forwarded to me from Disclosure <disclosure@aisle.com>
     indicating a problem with a loop condition in our xattr code. When
     I fixed the problem it exposed a related memory leak problem, and I
     fixed that too"

* tag 'for-linus-6.18-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
  fs/orangefs: Replace kzalloc + copy_from_user with memdup_user_nul
  orangefs: fix xattr related buffer overflow...
  orangefs: Remove unused type in macro fill_default_sys_attrs
This commit is contained in:
Linus Torvalds
2025-10-03 13:59:56 -07:00
parent a9b38767c6 11f6bce77e
commit f2327dc851
4 changed files with 16 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
fs/orangefs/namei.c
View File

@@ -38,8 +38,7 @@ static int orangefs_create(struct mnt_idmap *idmap,
new_op->upcall.req.create.parent_refn = parent->refn; new_op->upcall.req.create.parent_refn = parent->refn;
fill_default_sys_attrs(new_op->upcall.req.create.attributes, fill_default_sys_attrs(new_op->upcall.req.create.attributes, mode);
ORANGEFS_TYPE_METAFILE, mode);
strscpy(new_op->upcall.req.create.d_name, dentry->d_name.name); strscpy(new_op->upcall.req.create.d_name, dentry->d_name.name);
@@ -240,9 +239,7 @@ static int orangefs_symlink(struct mnt_idmap *idmap,
new_op->upcall.req.sym.parent_refn = parent->refn; new_op->upcall.req.sym.parent_refn = parent->refn;
fill_default_sys_attrs(new_op->upcall.req.sym.attributes, fill_default_sys_attrs(new_op->upcall.req.sym.attributes, mode);
ORANGEFS_TYPE_SYMLINK,
mode);
strscpy(new_op->upcall.req.sym.entry_name, dentry->d_name.name); strscpy(new_op->upcall.req.sym.entry_name, dentry->d_name.name);
strscpy(new_op->upcall.req.sym.target, symname); strscpy(new_op->upcall.req.sym.target, symname);
@@ -316,8 +313,7 @@ static struct dentry *orangefs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
new_op->upcall.req.mkdir.parent_refn = parent->refn; new_op->upcall.req.mkdir.parent_refn = parent->refn;
fill_default_sys_attrs(new_op->upcall.req.mkdir.attributes, fill_default_sys_attrs(new_op->upcall.req.mkdir.attributes, mode);
ORANGEFS_TYPE_DIRECTORY, mode);
strscpy(new_op->upcall.req.mkdir.d_name, dentry->d_name.name); strscpy(new_op->upcall.req.mkdir.d_name, dentry->d_name.name);

11
fs/orangefs/orangefs-debugfs.c
View File

@@ -440,14 +440,13 @@ static ssize_t orangefs_debug_write(struct file *file,
count = ORANGEFS_MAX_DEBUG_STRING_LEN; count = ORANGEFS_MAX_DEBUG_STRING_LEN;
} }
buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); buf = memdup_user_nul(ubuf, count - 1);
if (!buf) if (IS_ERR(buf)) {
goto out;
if (copy_from_user(buf, ubuf, count - 1)) {
gossip_debug(GOSSIP_DEBUGFS_DEBUG, gossip_debug(GOSSIP_DEBUGFS_DEBUG,
"%s: copy_from_user failed!\n", "%s: memdup_user_nul failed!\n",
__func__); __func__);
rc = PTR_ERR(buf);
buf = NULL;
goto out; goto out;
} }

2
fs/orangefs/orangefs-kernel.h
View File

@@ -462,7 +462,7 @@ int service_operation(struct orangefs_kernel_op_s *op,
((ORANGEFS_SB(inode->i_sb)->flags & ORANGEFS_OPT_INTR) ? \ ((ORANGEFS_SB(inode->i_sb)->flags & ORANGEFS_OPT_INTR) ? \
ORANGEFS_OP_INTERRUPTIBLE : 0) ORANGEFS_OP_INTERRUPTIBLE : 0)
#define fill_default_sys_attrs(sys_attr, type, mode) \ #define fill_default_sys_attrs(sys_attr, mode) \
do { \ do { \
sys_attr.owner = from_kuid(&init_user_ns, current_fsuid()); \ sys_attr.owner = from_kuid(&init_user_ns, current_fsuid()); \
sys_attr.group = from_kgid(&init_user_ns, current_fsgid()); \ sys_attr.group = from_kgid(&init_user_ns, current_fsgid()); \

12
fs/orangefs/xattr.c
View File

@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
static unsigned int xattr_key(const char *key) static unsigned int xattr_key(const char *key)
{ {
unsigned int i = 0; unsigned int i = 0;
while (key) if (!key)
return 0;
while (*key)
i += *key++; i += *key++;
return i % 16; return i % 16;
} }
@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
cx->length = -1; cx->length = -1;
cx->timeout = jiffies + cx->timeout = jiffies +
orangefs_getattr_timeout_msecs*HZ/1000; orangefs_getattr_timeout_msecs*HZ/1000;
hash_add(orangefs_inode->xattr_cache, &cx->node, hlist_add_head( &cx->node,
xattr_key(cx->key)); &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
} }
} }
goto out_release_op; goto out_release_op;
@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
memcpy(cx->val, buffer, length); memcpy(cx->val, buffer, length);
cx->length = length; cx->length = length;
cx->timeout = jiffies + HZ; cx->timeout = jiffies + HZ;
hash_add(orangefs_inode->xattr_cache, &cx->node, hlist_add_head(&cx->node,
xattr_key(cx->key)); &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
} }
} }