summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDuane Griffin <duaneg@dghda.com>2008-12-19 21:47:10 +0100
committerAl Viro <viro@zeniv.linux.org.uk>2009-01-01 00:07:38 +0100
commita17d5232de7b53d34229de79ec22f4bb04adb7e4 (patch)
treed42a96bf5e0806e4a67404709a8fdf0ed4e551c0
parentfs/namespace.c: drop code after return (diff)
downloadlinux-a17d5232de7b53d34229de79ec22f4bb04adb7e4.tar.xz
linux-a17d5232de7b53d34229de79ec22f4bb04adb7e4.zip
eCryptfs: check readlink result was not an error before using it
The result from readlink is being used to index into the link name buffer without checking whether it is a valid length. If readlink returns an error this will fault or cause memory corruption. Cc: Tyler Hicks <tyhicks@linux.vnet.ibm.com> Cc: Dustin Kirkland <kirkland@canonical.com> Cc: ecryptfs-devel@lists.launchpad.net Signed-off-by: Duane Griffin <duaneg@dghda.com> Acked-by: Michael Halcrow <mhalcrow@us.ibm.com> Acked-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r--fs/ecryptfs/inode.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 89209f00f9c7..5e78fc179886 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -673,10 +673,11 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ "
"dentry->d_name.name = [%s]\n", dentry->d_name.name);
rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
- buf[rc] = '\0';
set_fs(old_fs);
if (rc < 0)
goto out_free;
+ else
+ buf[rc] = '\0';
rc = 0;
nd_set_link(nd, buf);
goto out;