tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ROMFS: fix length used with romfs_dev_strnlen() function

An interestingly corrupted romfs file system exposed a problem with the
romfs_dev_strnlen function: it's passing the wrong value to its helpers.
Rather than limit the string to the length passed in by the callers, it
uses the size of the device as the limit.

Signed-off-by: Bernd Schmidt <bernds_cb1@t-online.de>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Bernd Schmidt and committed by
Linus Torvalds ef1f7a7e c6c59927

+2 -2
+2 -2
fs/romfs/storage.c
··· 253 253 254 254 #ifdef CONFIG_ROMFS_ON_MTD 255 255 if (sb->s_mtd) 256 - return romfs_mtd_strnlen(sb, pos, limit); 256 + return romfs_mtd_strnlen(sb, pos, maxlen); 257 257 #endif 258 258 #ifdef CONFIG_ROMFS_ON_BLOCK 259 259 if (sb->s_bdev) 260 - return romfs_blk_strnlen(sb, pos, limit); 260 + return romfs_blk_strnlen(sb, pos, maxlen); 261 261 #endif 262 262 return -EIO; 263 263 }