Commit ef5305f1 authored Sep 08, 2018 by Dominique Martinet

9p: p9dirent_read: check network-provided name length

strcpy to dirent->d_name could overflow the buffer, use strscpy to check
the provided string length and error out if the size was too big.

While we are here, make the function return an error when the pdu
parsing failed, instead of returning the pdu offset as if it had been a
success...

Link: http://lkml.kernel.org/r/1536339057-21974-4-git-send-email-asmadeus@codewreck.org

Addresses-Coverity-ID: 139133 ("Copy into fixed size buffer")
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>

parent 473c7dd1

net/9p/protocol.c

+9 −3

Original line number	Diff line number	Diff line
		@@ -623,13 +623,19 @@ int p9dirent_read(struct p9_client clnt, char buf, int len,
		if (ret) {
		p9_debug(P9_DEBUG_9P, "<<< p9dirent_read failed: %d\n", ret);
		trace_9p_protocol_dump(clnt, &fake_pdu);
		goto out;
		return ret;
		}

		strcpy(dirent->d_name, nameptr);
		ret = strscpy(dirent->d_name, nameptr, sizeof(dirent->d_name));
		if (ret < 0) {
		p9_debug(P9_DEBUG_ERROR,
		"On the wire dirent name too long: %s\n",
		nameptr);
		kfree(nameptr);
		return ret;
		}
		kfree(nameptr);

		out:
		return fake_pdu.offset;
		}
		EXPORT_SYMBOL(p9dirent_read);