Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 810339ec authored by Xi Wang's avatar Xi Wang Committed by Alex Elder
Browse files

ceph: avoid panic with mismatched symlink sizes in fill_inode() 



Return -EINVAL rather than panic if iinfo->symlink_len and inode->i_size
do not match.

Also use kstrndup rather than kmalloc/memcpy.

Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
Reviewed-by: default avatarAlex Elder <elder@dreamhost.com>
parent a661fc56

fs/ceph/inode.c

+6 −5
Original line number Original line Diff line number Diff line
@@ -677,18 +677,19 @@ static int fill_inode(struct inode *inode, 
	case S_IFLNK:

	case S_IFLNK:

		inode->i_op = &ceph_symlink_iops;

		inode->i_op = &ceph_symlink_iops;

		if (!ci->i_symlink) {

		if (!ci->i_symlink) {

			int symlen = iinfo->symlink_len;

			u32 symlen = iinfo->symlink_len;

			char *sym;

			char *sym;





			BUG_ON(symlen != inode->i_size);

			spin_unlock(&ci->i_ceph_lock);

			spin_unlock(&ci->i_ceph_lock);





			err = -EINVAL;

			if (WARN_ON(symlen != inode->i_size))

				goto out;



			err = -ENOMEM;

			err = -ENOMEM;

			sym = kmalloc(symlen+1, GFP_NOFS);

			sym = kstrndup(iinfo->symlink, symlen, GFP_NOFS);

			if (!sym)

			if (!sym)

				goto out;

				goto out;

			memcpy(sym, iinfo->symlink, symlen);

			sym[symlen] = 0;





			spin_lock(&ci->i_ceph_lock);

			spin_lock(&ci->i_ceph_lock);

			if (!ci->i_symlink)

			if (!ci->i_symlink)