From: Martin Brandenburg <martin@omnibond.com>
Date: Wed, 16 Mar 2016 18:01:43 +0000 (-0400)
Subject: orangefs: sanitize listxattr and return EIO on impossible values
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=02a5cc537dfa222583b6b6c17451a67816fce9f5;p=linux-beck.git

orangefs: sanitize listxattr and return EIO on impossible values

Signed-off-by: Martin Brandenburg <martin@omnibond.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
---

diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
index 75a7dde8cc5f..ef5da7538cd5 100644
--- a/fs/orangefs/xattr.c
+++ b/fs/orangefs/xattr.c
@@ -394,6 +394,7 @@ try_again:
 		gossip_err("%s: impossible value for returned_count:%d:\n",
 		__func__,
 		returned_count);
+		ret = -EIO;
 		goto done;
 	}
 
@@ -401,6 +402,15 @@ try_again:
 	 * Check to see how much can be fit in the buffer. Fit only whole keys.
 	 */
 	for (i = 0; i < returned_count; i++) {
+		if (new_op->downcall.resp.listxattr.lengths[i] < 0 ||
+		    new_op->downcall.resp.listxattr.lengths[i] >
+		    ORANGEFS_MAX_XATTR_NAMELEN) {
+			gossip_err("%s: impossible value for lengths[%d]\n",
+			    __func__,
+			    new_op->downcall.resp.listxattr.lengths[i]);
+			ret = -EIO;
+			goto done;
+		}
 		if (total + new_op->downcall.resp.listxattr.lengths[i] > size)
 			goto done;