Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bfd4981f authored by David Howells's avatar David Howells Committed by Sasha Levin
Browse files

afs: Fix storage of cell names 



[ Upstream commit 719fdd32921fb7e3208db8832d32ae1c2d68900f ]

The cell name stored in the afs_cell struct is a 64-char + NUL buffer -
when it needs to be able to handle up to AFS_MAXCELLNAME (256 chars) + NUL.

Fix this by changing the array to a pointer and allocating the string.

Found using Coverity.

Fixes: 989782dc ("afs: Overhaul cell database management")
Reported-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 5cee9e67

fs/afs/cell.c

+9 −0
Original line number Diff line number Diff line
@@ -154,10 +154,17 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net, 
		return ERR_PTR(-ENOMEM);

	}



	cell->name = kmalloc(namelen + 1, GFP_KERNEL);

	if (!cell->name) {

		kfree(cell);

		return ERR_PTR(-ENOMEM);

	}



	cell->net = net;

	cell->name_len = namelen;

	for (i = 0; i < namelen; i++)

		cell->name[i] = tolower(name[i]);

	cell->name[i] = 0;



	atomic_set(&cell->usage, 2);

	INIT_WORK(&cell->manager, afs_manage_cell);
@@ -203,6 +210,7 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net, 
	if (ret == -EINVAL)

		printk(KERN_ERR "kAFS: bad VL server IP address\n");

error:

	kfree(cell->name);

	kfree(cell);

	_leave(" = %d", ret);

	return ERR_PTR(ret);
@@ -483,6 +491,7 @@ static void afs_cell_destroy(struct rcu_head *rcu) 


	afs_put_vlserverlist(cell->net, rcu_access_pointer(cell->vl_servers));

	key_put(cell->anonymous_key);

	kfree(cell->name);

	kfree(cell);



	_leave(" [destroyed]");

fs/afs/internal.h

+1 −1
Original line number Diff line number Diff line
@@ -397,7 +397,7 @@ struct afs_cell { 
	struct afs_vlserver_list __rcu *vl_servers;



	u8			name_len;	/* Length of name */

	char			name[64 + 1];	/* Cell name, case-flattened and NUL-padded */

	char			*name;		/* Cell name, case-flattened and NUL-padded */

};



/*