Commit 953aa9d1 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Darrick J. Wong
Browse files

xfs: clear kernel only flags in XFS_IOC_ATTRMULTI_BY_HANDLE 



Don't allow passing arbitrary flags as they change behavior including
memory allocation that the call stack is not prepared for.

Fixes: ddbca70c ("xfs: allocate xattr buffer on demand")
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
parent 5a57c05b

fs/xfs/libxfs/xfs_attr.h

+5 −2
Original line number Diff line number Diff line
@@ -26,7 +26,7 @@ struct xfs_attr_list_context; 
 *========================================================================*/





#define ATTR_DONTFOLLOW	0x0001	/* -- unused, from IRIX -- */

#define ATTR_DONTFOLLOW	0x0001	/* -- ignored, from IRIX -- */

#define ATTR_ROOT	0x0002	/* use attrs in root (trusted) namespace */

#define ATTR_TRUST	0x0004	/* -- unused, from IRIX -- */

#define ATTR_SECURE	0x0008	/* use attrs in security namespace */
@@ -37,7 +37,10 @@ struct xfs_attr_list_context; 
#define ATTR_KERNOVAL	0x2000	/* [kernel] get attr size only, not value */



#define ATTR_INCOMPLETE	0x4000	/* [kernel] return INCOMPLETE attr keys */

#define ATTR_ALLOC	0x8000	/* allocate xattr buffer on demand */

#define ATTR_ALLOC	0x8000	/* [kernel] allocate xattr buffer on demand */



#define ATTR_KERNEL_FLAGS \

	(ATTR_KERNOTIME | ATTR_KERNOVAL | ATTR_INCOMPLETE | ATTR_ALLOC)



#define XFS_ATTR_FLAGS \

	{ ATTR_DONTFOLLOW, 	"DONTFOLLOW" }, \

fs/xfs/xfs_ioctl.c

+2 −0
Original line number Diff line number Diff line
@@ -462,6 +462,8 @@ xfs_attrmulti_by_handle( 


	error = 0;

	for (i = 0; i < am_hreq.opcount; i++) {

		ops[i].am_flags &= ~ATTR_KERNEL_FLAGS;



		ops[i].am_error = strncpy_from_user((char *)attr_name,

				ops[i].am_attrname, MAXNAMELEN);

		if (ops[i].am_error == 0 || ops[i].am_error == MAXNAMELEN)

fs/xfs/xfs_ioctl32.c

+2 −0
Original line number Diff line number Diff line
@@ -450,6 +450,8 @@ xfs_compat_attrmulti_by_handle( 


	error = 0;

	for (i = 0; i < am_hreq.opcount; i++) {

		ops[i].am_flags &= ~ATTR_KERNEL_FLAGS;



		ops[i].am_error = strncpy_from_user((char *)attr_name,

				compat_ptr(ops[i].am_attrname),

				MAXNAMELEN);

CRA Git | Maintained and supported by SUSTech CRA and CCSE