Skip to contentSkip to conversation

Patch "orangefs: clean up oversize xattr validation" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message May 17, 2017

Subsystems (2)
Stable branch Orangefs filesystem
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

orangefs: clean up oversize xattr validation

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
orangefs-clean-up-oversize-xattr-validation.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From e675c5ec51fe2554719a7b6bcdbef0a770f2c19b Mon Sep 17 00:00:00 2001

From: Martin Brandenburg <[email protected]>
Date: Tue, 25 Apr 2017 15:37:57 -0400
Subject: orangefs: clean up oversize xattr validation

From: Martin Brandenburg <[email protected]>

commit e675c5ec51fe2554719a7b6bcdbef0a770f2c19b upstream.

Also don't check flags as this has been validated by the VFS already.

Fix an off-by-one error in the max size checking.

Stop logging just because userspace wants to write attributes which do not fit.

This and the previous commit fix xfstests generic/020.

Signed-off-by Martin Brandenburg <[email protected]>
Signed-off-by Mike Marshall <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 fs/orangefs/xattr.c |   24 +++++++-----------------
 1 file changed, 7 insertions(+), 17 deletions(-)
fs/orangefs/xattr.c +7 -17
@@ -76,11 +76,8 @@ ssize_t orangefs_inode_getxattr(struct i
 	if (S_ISLNK(inode->i_mode))
 		return -EOPNOTSUPP;
 
-	if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) {
-		gossip_err("Invalid key length (%d)\n",
-			   (int)strlen(name));
+	if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN)
 		return -EINVAL;
-	}
 
 	fsuid = from_kuid(&init_user_ns, current_fsuid());
 	fsgid = from_kgid(&init_user_ns, current_fsgid());

@@ -172,6 +169,9 @@ static int orangefs_inode_removexattr(st
 	struct orangefs_kernel_op_s *new_op = NULL;
 	int ret = -ENOMEM;
 
+	if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN)
+		return -EINVAL;
+
 	down_write(&orangefs_inode->xattr_sem);
 	new_op = op_alloc(ORANGEFS_VFS_OP_REMOVEXATTR);
 	if (!new_op)

@@ -231,23 +231,13 @@ int orangefs_inode_setxattr(struct inode
 		     "%s: name %s, buffer_size %zd\n",
 		     __func__, name, size);
 
-	if (size >= ORANGEFS_MAX_XATTR_VALUELEN ||
-	    flags < 0) {
-		gossip_err("orangefs_inode_setxattr: bogus values of size(%d), flags(%d)\n",
-			   (int)size,
-			   flags);
+	if (size > ORANGEFS_MAX_XATTR_VALUELEN)
+		return -EINVAL;
+	if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN)
 		return -EINVAL;
-	}
 
 	internal_flag = convert_to_internal_xattr_flags(flags);
 
-	if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) {
-		gossip_err
-		    ("orangefs_inode_setxattr: bogus key size (%d)\n",
-		     (int)(strlen(name)));
-		return -EINVAL;
-	}
-
 	/* This is equivalent to a removexattr */
 	if (size == 0 && value == NULL) {
 		gossip_debug(GOSSIP_XATTR_DEBUG,

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/orangefs-do-not-check-possibly-stale-size-on-truncate.patch queue-4.9/orangefs-fix-bounds-check-for-listxattr.patch queue-4.9/orangefs-clean-up-oversize-xattr-validation.patch queue-4.9/orangefs-do-not-set-getattr_time-on-orangefs_lookup.patch