diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2023-04-10 22:25:08 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2023-04-10 22:25:08 +0200 |
| commit | c118b59e71d2a910ee300f8be40fa864a91bb6ca (patch) | |
| tree | c6200c5449e1802a2c7ef66373d6185468051139 /fs | |
| parent | Merge tag 'uml-for-linus-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kerne... (diff) | |
| parent | Update email address and mailing list for v9fs (diff) | |
| download | linux-c118b59e71d2a910ee300f8be40fa864a91bb6ca.tar.xz linux-c118b59e71d2a910ee300f8be40fa864a91bb6ca.zip | |
Merge tag '9p-6.3-fixes-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs
Pull 9p fixes from Eric Van Hensbergen:
"These are some collected fixes for the 6.3-rc series that have been
passed our 9p regression tests and been in for-next for at least a
week.
They include a fix for a KASAN reported problem in the extended
attribute handling code and a use after free in the xen transport.
This also includes some updates for the MAINTAINERS file including the
transition of our development mailing list from sourceforge.net to
lists.linux.dev"
* tag '9p-6.3-fixes-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
Update email address and mailing list for v9fs
9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
9P FS: Fix wild-memory-access write in v9fs_get_acl
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/9p/xattr.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/fs/9p/xattr.c b/fs/9p/xattr.c index 50f7f3f6b55e..1974a38bce20 100644 --- a/fs/9p/xattr.c +++ b/fs/9p/xattr.c @@ -35,10 +35,12 @@ ssize_t v9fs_fid_xattr_get(struct p9_fid *fid, const char *name, return retval; } if (attr_size > buffer_size) { - if (!buffer_size) /* request to get the attr_size */ - retval = attr_size; - else + if (buffer_size) retval = -ERANGE; + else if (attr_size > SSIZE_MAX) + retval = -EOVERFLOW; + else /* request to get the attr_size */ + retval = attr_size; } else { iov_iter_truncate(&to, attr_size); retval = p9_client_read(attr_fid, 0, &to, &err); |