Ping... Sorry, I had actually completely forgotten about this one.
On 07/07/18 19:52, Bernd Edlinger wrote: > The terminating NUL byte is only there because the buffer is > allocated with kzalloc(PAGE_SIZE, GFP_KERNEL), but since the > range-check is off-by-one, and PAGE_SIZE==PATH_MAX, the > returned string may not be zero-terminated if it is exactly > PATH_MAX characters long. Furthermore also the initial loop > may theoretically exceed PATH_MAX and cause a fault. > > Signed-off-by: Bernd Edlinger <bernd.edlin...@hotmail.de> > --- > fs/kernfs/symlink.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c > index 08ccabd..774bada 100644 > --- a/fs/kernfs/symlink.c > +++ b/fs/kernfs/symlink.c > @@ -63,6 +63,9 @@ static int kernfs_get_target_path(struct kernfs_node > if (base == kn) > break; > > + if ((s - path) + 3 >= PATH_MAX) > + return -ENAMETOOLONG; > + > strcpy(s, "../"); > s += 3; > base = base->parent; > @@ -79,7 +82,7 @@ static int kernfs_get_target_path(struct kernfs_node > if (len < 2) > return -EINVAL; > len--; > - if ((s - path) + len > PATH_MAX) > + if ((s - path) + len >= PATH_MAX) > return -ENAMETOOLONG; > > /* reverse fillup of target string from target to base */
