Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-linus-4.6-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux
Pull orangefs fixes from Mike Marshall:
"Orangefs cleanups and a strncpy vulnerability fix.
Cleanups:
- remove an unused variable from orangefs_readdir.
- clean up printk wrapper used for ofs "gossip" debugging.
- clean up truncate ctime and mtime setting in inode.c
- remove a useless null check found by coccinelle.
- optimize some memcpy/memset boilerplate code.
- remove some useless sanity checks from xattr.c
Fix:
- fix a potential strncpy vulnerability"
* tag 'for-linus-4.6-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
orangefs: remove unused variable
orangefs: Add KERN_<LEVEL> to gossip_<level> macros
orangefs: strncpy -> strscpy
orangefs: clean up truncate ctime and mtime setting
Orangefs: fix ifnullfree.cocci warnings
Orangefs: optimize boilerplate code.
Orangefs: xattr.c cleanup
+27
-52
+1
-3
fs/orangefs/dir.c
+1
-3
fs/orangefs/dir.c
···
153
153
struct dentry *dentry = file->f_path.dentry;
154
154
struct orangefs_kernel_op_s *new_op = NULL;
155
155
struct orangefs_inode_s *orangefs_inode = ORANGEFS_I(dentry->d_inode);
156
-
int buffer_full = 0;
157
156
struct orangefs_readdir_response_s readdir_response;
158
157
void *dents_buf;
159
158
int i = 0;
···
349
350
/*
350
351
* Did we hit the end of the directory?
351
352
*/
352
-
if (readdir_response.token == ORANGEFS_READDIR_END &&
353
-
!buffer_full) {
353
+
if (readdir_response.token == ORANGEFS_READDIR_END) {
354
354
gossip_debug(GOSSIP_DIR_DEBUG,
355
355
"End of dir detected; setting ctx->pos to ORANGEFS_READDIR_END.\n");
356
356
ctx->pos = ORANGEFS_READDIR_END;
+1
-15
fs/orangefs/inode.c
+1
-15
fs/orangefs/inode.c
···
204
204
if (ret != 0)
205
205
return ret;
206
206
207
-
/*
208
-
* Only change the c/mtime if we are changing the size or we are
209
-
* explicitly asked to change it. This handles the semantic difference
210
-
* between truncate() and ftruncate() as implemented in the VFS.
211
-
*
212
-
* The regular truncate() case without ATTR_CTIME and ATTR_MTIME is a
213
-
* special case where we need to update the times despite not having
214
-
* these flags set. For all other operations the VFS set these flags
215
-
* explicitly if it wants a timestamp update.
216
-
*/
217
-
if (orig_size != i_size_read(inode) &&
218
-
!(iattr->ia_valid & (ATTR_CTIME | ATTR_MTIME))) {
219
-
iattr->ia_ctime = iattr->ia_mtime =
220
-
current_fs_time(inode->i_sb);
207
+
if (orig_size != i_size_read(inode))
221
208
iattr->ia_valid |= ATTR_CTIME | ATTR_MTIME;
222
-
}
223
209
224
210
return ret;
225
211
}
+1
-2
fs/orangefs/orangefs-debugfs.c
+1
-2
fs/orangefs/orangefs-debugfs.c
+5
-1
fs/orangefs/orangefs-utils.c
+5
-1
fs/orangefs/orangefs-utils.c
···
315
315
inode->i_size = (loff_t)strlen(new_op->
316
316
downcall.resp.getattr.link_target);
317
317
orangefs_inode->blksize = (1 << inode->i_blkbits);
318
-
strlcpy(orangefs_inode->link_target,
318
+
ret = strscpy(orangefs_inode->link_target,
319
319
new_op->downcall.resp.getattr.link_target,
320
320
ORANGEFS_NAME_MAX);
321
+
if (ret == -E2BIG) {
322
+
ret = -EIO;
323
+
goto out;
324
+
}
321
325
inode->i_link = orangefs_inode->link_target;
322
326
}
323
327
break;
+17
-14
fs/orangefs/protocol.h
+17
-14
fs/orangefs/protocol.h
···
1
+
#include <linux/kernel.h>
1
2
#include <linux/types.h>
2
3
#include <linux/spinlock_types.h>
3
4
#include <linux/slab.h>
···
75
74
void *p, int size)
76
75
{
77
76
78
-
memset(p, 0, size);
79
77
memcpy(p, kh->u, 16);
78
+
memset(p + 16, 0, size - 16);
80
79
81
80
}
82
81
···
428
427
/* gossip.h *****************************************************************/
429
428
430
429
#ifdef GOSSIP_DISABLE_DEBUG
431
-
#define gossip_debug(mask, format, f...) do {} while (0)
430
+
#define gossip_debug(mask, fmt, ...) \
431
+
do { \
432
+
if (0) \
433
+
printk(KERN_DEBUG fmt, ##__VA_ARGS__); \
434
+
} while (0)
432
435
#else
433
436
extern __u64 gossip_debug_mask;
434
437
extern struct client_debug_mask client_debug_mask;
435
438
436
439
/* try to avoid function call overhead by checking masks in macro */
437
-
#define gossip_debug(mask, format, f...) \
438
-
do { \
439
-
if (gossip_debug_mask & mask) \
440
-
printk(format, ##f); \
440
+
#define gossip_debug(mask, fmt, ...) \
441
+
do { \
442
+
if (gossip_debug_mask & (mask)) \
443
+
printk(KERN_DEBUG fmt, ##__VA_ARGS__); \
441
444
} while (0)
442
445
#endif /* GOSSIP_DISABLE_DEBUG */
443
446
444
447
/* do file and line number printouts w/ the GNU preprocessor */
445
-
#define gossip_ldebug(mask, format, f...) \
446
-
gossip_debug(mask, "%s: " format, __func__, ##f)
448
+
#define gossip_ldebug(mask, fmt, ...) \
449
+
gossip_debug(mask, "%s: " fmt, __func__, ##__VA_ARGS__)
447
450
448
-
#define gossip_err printk
449
-
#define gossip_lerr(format, f...) \
450
-
gossip_err("%s line %d: " format, \
451
-
__FILE__, \
452
-
__LINE__, \
453
-
##f)
451
+
#define gossip_err pr_err
452
+
#define gossip_lerr(fmt, ...) \
453
+
gossip_err("%s line %d: " fmt, \
454
+
__FILE__, __LINE__, ##__VA_ARGS__)
+2
-17
fs/orangefs/xattr.c
+2
-17
fs/orangefs/xattr.c
···
73
73
"%s: prefix %s name %s, buffer_size %zd\n",
74
74
__func__, prefix, name, size);
75
75
76
-
if (name == NULL || (size > 0 && buffer == NULL)) {
77
-
gossip_err("orangefs_inode_getxattr: bogus NULL pointers\n");
78
-
return -EINVAL;
79
-
}
80
76
if ((strlen(name) + strlen(prefix)) >= ORANGEFS_MAX_XATTR_NAMELEN) {
81
77
gossip_err("Invalid key length (%d)\n",
82
78
(int)(strlen(name) + strlen(prefix)));
···
142
146
goto out_release_op;
143
147
}
144
148
145
-
memset(buffer, 0, size);
146
149
memcpy(buffer, new_op->downcall.resp.getxattr.val, length);
150
+
memset(buffer + length, 0, size - length);
147
151
gossip_debug(GOSSIP_XATTR_DEBUG,
148
152
"orangefs_inode_getxattr: inode %pU "
149
153
"key %s key_sz %d, val_len %d\n",
···
235
239
"%s: prefix %s, name %s, buffer_size %zd\n",
236
240
__func__, prefix, name, size);
237
241
238
-
if (size < 0 ||
239
-
size >= ORANGEFS_MAX_XATTR_VALUELEN ||
242
+
if (size >= ORANGEFS_MAX_XATTR_VALUELEN ||
240
243
flags < 0) {
241
244
gossip_err("orangefs_inode_setxattr: bogus values of size(%d), flags(%d)\n",
242
245
(int)size,
243
246
flags);
244
-
return -EINVAL;
245
-
}
246
-
247
-
if (name == NULL ||
248
-
(size > 0 && value == NULL)) {
249
-
gossip_err("orangefs_inode_setxattr: bogus NULL pointers!\n");
250
247
return -EINVAL;
251
248
}
252
249
···
340
351
341
352
if (size > 0 && buffer == NULL) {
342
353
gossip_err("%s: bogus NULL pointers\n", __func__);
343
-
return -EINVAL;
344
-
}
345
-
if (size < 0) {
346
-
gossip_err("Invalid size (%d)\n", (int)size);
347
354
return -EINVAL;
348
355
}
349
356