Skip to content

Commit

Permalink
xfs: revert commit 8954c44
Browse files Browse the repository at this point in the history
The name passed into __xfs_xattr_put_listent is exactly namelen bytes
long and not null-terminated.  Passing namelen+1 to the strscpy function

    strscpy(offset, (char *)name, namelen + 1);

is therefore wrong.  Go back to the old code, which works fine because
strncpy won't find a null in @name and stops after namelen bytes.  It
really could be a memcpy call, but it worked for years.

Reported-by: syzbot+898115bc6d7140437215@syzkaller.appspotmail.com
Fixes: 8954c44 ("xfs: use strscpy() to instead of strncpy()")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
  • Loading branch information
Darrick J. Wong committed Feb 10, 2023
1 parent 2ee8333 commit dd07bb8
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion fs/xfs/xfs_xattr.c
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,9 @@ __xfs_xattr_put_listent(
offset = context->buffer + context->count;
memcpy(offset, prefix, prefix_len);
offset += prefix_len;
strscpy(offset, (char *)name, namelen + 1); /* real name */
strncpy(offset, (char *)name, namelen); /* real name */
offset += namelen;
*offset = '\0';

compute_size:
context->count += prefix_len + namelen + 1;
Expand Down

0 comments on commit dd07bb8

Please sign in to comment.