Skip to contentSkip to conversation

ceph: avoid panic with mismatched symlink sizes in fill_inode()

PATCH New Alex Elder 1 participant 1 message Feb 29, 2012 Ceph client

lore
Share & tools
lore

Alex Elder

author
#0 lore raw

PATCH 1/1 ceph: avoid panic with mismatched symlink sizes in fill_inode()

Return -EINVAL rather than panic if iinfo->symlink_len and inode->i_size do not match.

Also use kstrndup rather than kmalloc/memcpy.

Signed-off-by Xi Wang <[email protected]>
Reviewed-by Alex Elder <[email protected]>
---
 fs/ceph/inode.c |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)
fs/ceph/inode.c +6 -5
index 87fb132..73e0f87 100644
@@ -678,18 +678,19 @@ static int fill_inode(struct inode *inode,
 	case S_IFLNK:
 		inode->i_op = &ceph_symlink_iops;
 		if (!ci->i_symlink) {
-			int symlen = iinfo->symlink_len;
+			u32 symlen = iinfo->symlink_len;
 			char *sym;
 
-			BUG_ON(symlen != inode->i_size);
 			spin_unlock(&ci->i_ceph_lock);
 
+			err = -EINVAL;
+			if (WARN_ON(symlen != inode->i_size))
+				goto out;
+
 			err = -ENOMEM;
-			sym = kmalloc(symlen+1, GFP_NOFS);
+			sym = kstrndup(iinfo->symlink, symlen, GFP_NOFS);
 			if (!sym)
 				goto out;
-			memcpy(sym, iinfo->symlink, symlen);
-			sym[symlen] = 0;
 
 			spin_lock(&ci->i_ceph_lock);
 			if (!ci->i_symlink)
Signature · 1 line
1.7.5.4