Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

orangefs: Two cleanups and a bug fix. 

Remove unused type in macro fill_default_sys_attrs
   Zhen Ni <zhen.ni@easystack.cn>
 
 Replace kzalloc + copy_from_user with memdup_user_nul
   Thorsten Blum <thorsten.blum@linux.dev>
 
 fix xattr related buffer overflow...
   A message was forwarded to me from Disclosure <disclosure@aisle.com>
   indicating a problem with a loop condition in our xattr code. When I
   fixed the problem it exposed a related memory leak problem, and I
   fixed that too.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEWLOQAZkv9m2xtUCf/Vh1C1u0YnAFAmjf3UoACgkQ/Vh1C1u0
 YnD4sRAAn9mzWpNTf/fQjFol99aiq4FD+AXR1BRZcOv+xOkOkMHPzE8hdx2IKXH7
 tnLV+DdNrCXr2wsHzCtTtcpbDMRIkrH4FvCA2VP7/vxPu0DwHYKeITFaXVELUT+b
 QW7AIu7WxbNwmEfCmv1wla8fjKXeDKTbwuaTSmOx9RL/4xy9/QTomix4QMqtC/G5
 ufkbrWWx94lmW8TH3DUex5lfwAXqU+yH5FPRtcxHSMikRoXjSUcNrhCTWJ1uZTaR
 uZfwU+pp6LZjxG7/0l+tOZpEEIltCMqs8gaSn3HQdIzPo5TAJksK6pylf/vOGYow
 klqgwoTWlylX2QcxE6+zi75EXkAa4EJxGsFI70DtKRy9LYbHQhneh2hS9u+desB+
 BnaqwtzAHfYdYl1hHefrp67dm/FkI14e/Mn9PbvnkpGrvZYvRjCBDd44mKaovJ2r
 b3Pt4KZTa56kZfNC3YQcVDkEMG9KHMhhDH+Afb7SmhWmvkcLsHTa4Gyc3qw3IR9f
 aHoqdN9okBWafI2NbL43PeauzZmTOQKqaBy6zHsvzBvCpCkdaEMDPOx+Tc5/jZGr
 eBQ7Ahad4tg+1cVzj3MyFQBdbEHRfc0cIu2iS4i/N0hBno4MvyBE7GkvKRog6ifT
 Y1wfPGWMvj9+7yZXlG8yo5n2eR2mBhNVsgrBrUd0RqpgNcU8EmQ=
 =FIza
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-6.18-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux

Pull orangefs updates from Mike Marshall:
 "Two cleanups and a bug fix:

   - Remove unused type in macro fill_default_sys_attrs (Zhen Ni)

   - Replace kzalloc + copy_from_user with memdup_user_nul (Thorsten Blum)

   - Fix xattr related buffer overflow...

     A message was forwarded to me from Disclosure <disclosure@aisle.com>
     indicating a problem with a loop condition in our xattr code. When
     I fixed the problem it exposed a related memory leak problem, and I
     fixed that too"

* tag 'for-linus-6.18-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
  fs/orangefs: Replace kzalloc + copy_from_user with memdup_user_nul
  orangefs: fix xattr related buffer overflow...
  orangefs: Remove unused type in macro fill_default_sys_attrs
This commit is contained in:
Linus Torvalds 2025-10-03 13:59:56 -07:00
parent a9b38767c6 11f6bce77e
commit f2327dc851
4 changed files with 16 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/orangefs/namei.c
View File

@ -38,8 +38,7 @@ static int orangefs_create(struct mnt_idmap *idmap,
new_op->upcall.req.create.parent_refn = parent->refn;
fill_default_sys_attrs(new_op->upcall.req.create.attributes,
ORANGEFS_TYPE_METAFILE, mode);
fill_default_sys_attrs(new_op->upcall.req.create.attributes, mode);
strscpy(new_op->upcall.req.create.d_name, dentry->d_name.name);
@ -240,9 +239,7 @@ static int orangefs_symlink(struct mnt_idmap *idmap,
new_op->upcall.req.sym.parent_refn = parent->refn;
fill_default_sys_attrs(new_op->upcall.req.sym.attributes,
ORANGEFS_TYPE_SYMLINK,
mode);
fill_default_sys_attrs(new_op->upcall.req.sym.attributes, mode);
strscpy(new_op->upcall.req.sym.entry_name, dentry->d_name.name);
strscpy(new_op->upcall.req.sym.target, symname);
@ -316,8 +313,7 @@ static struct dentry *orangefs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
new_op->upcall.req.mkdir.parent_refn = parent->refn;
fill_default_sys_attrs(new_op->upcall.req.mkdir.attributes,
ORANGEFS_TYPE_DIRECTORY, mode);
fill_default_sys_attrs(new_op->upcall.req.mkdir.attributes, mode);
strscpy(new_op->upcall.req.mkdir.d_name, dentry->d_name.name);

11
fs/orangefs/orangefs-debugfs.c
View File

@ -440,14 +440,13 @@ static ssize_t orangefs_debug_write(struct file *file,
count = ORANGEFS_MAX_DEBUG_STRING_LEN;
}
buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL);
if (!buf)
goto out;
if (copy_from_user(buf, ubuf, count - 1)) {
buf = memdup_user_nul(ubuf, count - 1);
if (IS_ERR(buf)) {
gossip_debug(GOSSIP_DEBUGFS_DEBUG,
"%s: copy_from_user failed!\n",
"%s: memdup_user_nul failed!\n",
__func__);
rc = PTR_ERR(buf);
buf = NULL;
goto out;
}

2
fs/orangefs/orangefs-kernel.h
View File

@ -462,7 +462,7 @@ int service_operation(struct orangefs_kernel_op_s *op,
((ORANGEFS_SB(inode->i_sb)->flags & ORANGEFS_OPT_INTR) ? \
ORANGEFS_OP_INTERRUPTIBLE : 0)
#define fill_default_sys_attrs(sys_attr, type, mode) \
#define fill_default_sys_attrs(sys_attr, mode) \
do { \
sys_attr.owner = from_kuid(&init_user_ns, current_fsuid()); \
sys_attr.group = from_kgid(&init_user_ns, current_fsgid()); \

12
fs/orangefs/xattr.c
View File

@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
static unsigned int xattr_key(const char *key)
{
unsigned int i = 0;
while (key)
if (!key)
return 0;
while (*key)
i += *key++;
return i % 16;
}
@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
cx->length = -1;
cx->timeout = jiffies +
orangefs_getattr_timeout_msecs*HZ/1000;
hash_add(orangefs_inode->xattr_cache, &cx->node,
xattr_key(cx->key));
hlist_add_head( &cx->node,
&orangefs_inode->xattr_cache[xattr_key(cx->key)]);
}
}
goto out_release_op;
@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
memcpy(cx->val, buffer, length);
cx->length = length;
cx->timeout = jiffies + HZ;
hash_add(orangefs_inode->xattr_cache, &cx->node,
xattr_key(cx->key));
hlist_add_head(&cx->node,
&orangefs_inode->xattr_cache[xattr_key(cx->key)]);
}
}