staging: lustre: validate size in ll_setxattr()

PATCH New Dan Carpenter 1 participant 1 message Oct 22, 2014

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2014-10-22 14:23 UTC #0 lore raw

PATCH v2 2/2 staging: lustre: validate size in ll_setxattr()

If size is smaller than the lov_user_md struct then we are reading beyond the end of the buffer. I guess this is an information leak or it could cause an Oops if the memory is not mapped.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: Andrew Perepechko pointed out that the check needs to be inside the if statement.

drivers/staging/lustre/lustre/llite/xattr.c +3 -0

index 252a619..3ad9796 100644
@@ -234,6 +234,9 @@ int ll_setxattr(struct dentry *dentry, const char *name,
 		struct lov_user_md *lump = (struct lov_user_md *)value;
 		int rc = 0;
 
+		if (size != 0 && size < sizeof(struct lov_user_md))
+			return -EINVAL;
+
 		/* Attributes that are saved via getxattr will always have
 		 * the stripe_offset as 0.  Instead, the MDS should be
 		 * allowed to pick the starting OST index.   b846 */