diff options
| author | Darrick J. Wong <darrick.wong@oracle.com> | 2018-09-29 06:40:40 +0300 |
|---|---|---|
| committer | Dave Chinner <david@fromorbit.com> | 2018-09-29 06:40:40 +0300 |
| commit | ae29478766f4c8e16edca6fe1e25d73c47991ebe (patch) | |
| tree | 0e37ce3de3e13f7a2f3c1e00651c25905c70fac6 /fs/xfs/xfs_iops.c | |
| parent | 5b394b2ddf0347bef56e50c69a58773c94343ff3 (diff) | |
| download | linux-ae29478766f4c8e16edca6fe1e25d73c47991ebe.tar.xz | |
xfs: don't crash the vfs on a garbage inline symlink
The VFS routine that calls ->get_link blindly copies whatever's returned
into the user's buffer. If we return a NULL pointer, the vfs will
crash on the null pointer. Therefore, return -EFSCORRUPTED instead of
blowing up the kernel.
[dgc: clean up with hch's suggestions]
Reported-by: wen.xu@gatech.edu
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Diffstat (limited to 'fs/xfs/xfs_iops.c')
| -rw-r--r-- | fs/xfs/xfs_iops.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c index c3e74f9128e8..f48ffd7a8d3e 100644 --- a/fs/xfs/xfs_iops.c +++ b/fs/xfs/xfs_iops.c @@ -471,8 +471,18 @@ xfs_vn_get_link_inline( struct inode *inode, struct delayed_call *done) { + char *link; + ASSERT(XFS_I(inode)->i_df.if_flags & XFS_IFINLINE); - return XFS_I(inode)->i_df.if_u1.if_data; + + /* + * The VFS crashes on a NULL pointer, so return -EFSCORRUPTED if + * if_data is junk. + */ + link = XFS_I(inode)->i_df.if_u1.if_data; + if (!link) + return ERR_PTR(-EFSCORRUPTED); + return link; } STATIC int |