shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 03:15:31 +09:00
Code Issues Packages Projects Releases Wiki Activity

ANDROID: fuse-bpf: Fix filldir

Browse Source 
filldir used strcpy, potentially leading to writing the ending null past
the current page. fuse_dirents are not null terminated, so we switch to
using memcpy to avoid adding an extraneous null, which would be
overwritten if the name was already byte aligned.

Bug: 217570523
Test: generic/027
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Change-Id: Ic5d1f1887a113e1a3319998bad47cfbac3d90baa
This commit is contained in:
Daniel Rosenberg
2022-02-15 15:57:14 -08:00
parent c4ac8b4248
commit bea68245ef
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
fs/fuse/backing.c
View File

@@ -191,7 +191,8 @@ void *fuse_open_finalize(struct fuse_args *fa,
struct fuse_file *ff = file->private_data;
struct fuse_open_out *foo = fa->out_args[0].value;
ff->fh = foo->fh;
if (ff)
ff->fh = foo->fh;
return 0;
}
@@ -1987,7 +1988,7 @@ static int filldir(struct dir_context *ctx, const char *name, int namelen,
.type = d_type,
};
strcpy(fd->name, name);
memcpy(fd->name, name, namelen);
ec->offset += FUSE_DIRENT_SIZE(fd);
return 0;

10
tools/testing/selftests/filesystems/fuse/fuse_test.c
View File

@@ -524,12 +524,14 @@ static int bpf_test_redact_readdir(const char *mount_dir)
bool is_dot;
fuse_dirent_in = (struct fuse_dirent *) dirs_in;
is_dot = !strcmp(fuse_dirent_in->name, ".") ||
!strcmp(fuse_dirent_in->name, "..");
is_dot = (fuse_dirent_in->namelen == 1 &&
!strncmp(fuse_dirent_in->name, ".", 1)) ||
(fuse_dirent_in->namelen == 2 &&
!strncmp(fuse_dirent_in->name, "..", 2));
dir_ent_len = FUSE_DIRENT_ALIGN(
sizeof(*fuse_dirent_in) +
fuse_dirent_in->namelen + 1);
fuse_dirent_in->namelen);
if (dirs_in + dir_ent_len < bytes_in + res)
next = (struct fuse_dirent *)
@@ -538,7 +540,7 @@ static int bpf_test_redact_readdir(const char *mount_dir)
if (!skip || is_dot) {
memcpy(dirs_out, fuse_dirent_in,
sizeof(struct fuse_dirent) +
fuse_dirent_in->namelen + 1);
fuse_dirent_in->namelen);
length_out += dir_ent_len;
}
again = ((skip && !is_dot) && next);