Commit 810339ec authored by Xi Wang's avatar Xi Wang Committed by Alex Elder
Browse files

ceph: avoid panic with mismatched symlink sizes in fill_inode() 



Return -EINVAL rather than panic if iinfo->symlink_len and inode->i_size
do not match.

Also use kstrndup rather than kmalloc/memcpy.

Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
Reviewed-by: default avatarAlex Elder <elder@dreamhost.com>
parent a661fc56

fs/ceph/inode.c

+6 −5
Original line number Diff line number Diff line
@@ -677,18 +677,19 @@ static int fill_inode(struct inode *inode, 
	case S_IFLNK:

		inode->i_op = &ceph_symlink_iops;

		if (!ci->i_symlink) {

			int symlen = iinfo->symlink_len;

			u32 symlen = iinfo->symlink_len;

			char *sym;



			BUG_ON(symlen != inode->i_size);

			spin_unlock(&ci->i_ceph_lock);



			err = -EINVAL;

			if (WARN_ON(symlen != inode->i_size))

				goto out;



			err = -ENOMEM;

			sym = kmalloc(symlen+1, GFP_NOFS);

			sym = kstrndup(iinfo->symlink, symlen, GFP_NOFS);

			if (!sym)

				goto out;

			memcpy(sym, iinfo->symlink, symlen);

			sym[symlen] = 0;



			spin_lock(&ci->i_ceph_lock);

			if (!ci->i_symlink)