diff options
| author | Alex Shi <alex.shi@linaro.org> | 2016-10-29 13:26:04 +0800 |
|---|---|---|
| committer | Alex Shi <alex.shi@linaro.org> | 2016-10-29 13:26:04 +0800 |
| commit | c11a255c622e7a2d312f4080c6ef529dd67b3c38 (patch) | |
| tree | c7d36f8014e9da35e4b772cfdc1779ec0449d657 /fs/overlayfs/copy_up.c | |
| parent | 273daee0be36235886622396eedb618fc5de0213 (diff) | |
| parent | 25f89e269f5c5d06594098cc3b1d97554249f3f9 (diff) | |
Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android
Diffstat (limited to 'fs/overlayfs/copy_up.c')
| -rw-r--r-- | fs/overlayfs/copy_up.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c index 9e52609cd683..ea0dd9ee138d 100644 --- a/fs/overlayfs/copy_up.c +++ b/fs/overlayfs/copy_up.c @@ -25,6 +25,7 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new) ssize_t list_size, size, value_size = 0; char *buf, *name, *value = NULL; int uninitialized_var(error); + size_t slen; if (!old->d_inode->i_op->getxattr || !new->d_inode->i_op->getxattr) @@ -47,7 +48,16 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new) goto out; } - for (name = buf; name < (buf + list_size); name += strlen(name) + 1) { + for (name = buf; list_size; name += slen) { + slen = strnlen(name, list_size) + 1; + + /* underlying fs providing us with an broken xattr list? */ + if (WARN_ON(slen > list_size)) { + error = -EIO; + break; + } + list_size -= slen; + if (ovl_is_private_xattr(name)) continue; retry: |