Skip to content

Commit a75b380

Browse files
committed
qnx4: Use get_directory_fname() in qnx4_match()
Use the new common directory entry name accessor helper to avoid confusing the compiler about over-running the file name buffer. Avoids false positive buffer overflow warning: [ 4849.636861] detected buffer overflow in strlen [ 4849.636897] ------------[ cut here ]------------ [ 4849.636902] kernel BUG at lib/string.c:1165! ... [ 4849.637047] Call Trace: ... [ 4849.637251] qnx4_find_entry.cold+0xc/0x18 [qnx4] [ 4849.637264] qnx4_lookup+0x3c/0xa0 [qnx4] Reported-by: Ronald Monthero <debug.penguin32@gmail.com> Closes: https://lore.kernel.org/lkml/20231112095353.579855-1-debug.penguin32@gmail.com/ Acked-by: Anders Larsen <al@alarsen.net> Link: https://lore.kernel.org/r/20231130205120.3642477-2-keescook@chromium.org Signed-off-by: Kees Cook <keescook@chromium.org>
1 parent 5385399 commit a75b380

1 file changed

Lines changed: 11 additions & 18 deletions

File tree

fs/qnx4/namei.c

Lines changed: 11 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -26,31 +26,24 @@
2626
static int qnx4_match(int len, const char *name,
2727
struct buffer_head *bh, unsigned long *offset)
2828
{
29-
struct qnx4_inode_entry *de;
30-
int namelen, thislen;
29+
union qnx4_directory_entry *de;
30+
const char *fname;
31+
int fnamelen;
3132

3233
if (bh == NULL) {
3334
printk(KERN_WARNING "qnx4: matching unassigned buffer !\n");
3435
return 0;
3536
}
36-
de = (struct qnx4_inode_entry *) (bh->b_data + *offset);
37+
de = (union qnx4_directory_entry *) (bh->b_data + *offset);
3738
*offset += QNX4_DIR_ENTRY_SIZE;
38-
if ((de->di_status & QNX4_FILE_LINK) != 0) {
39-
namelen = QNX4_NAME_MAX;
40-
} else {
41-
namelen = QNX4_SHORT_NAME_MAX;
42-
}
43-
thislen = strlen( de->di_fname );
44-
if ( thislen > namelen )
45-
thislen = namelen;
46-
if (len != thislen) {
39+
40+
fname = get_entry_fname(de, &fnamelen);
41+
if (!fname || len != fnamelen)
4742
return 0;
48-
}
49-
if (strncmp(name, de->di_fname, len) == 0) {
50-
if ((de->di_status & (QNX4_FILE_USED|QNX4_FILE_LINK)) != 0) {
51-
return 1;
52-
}
53-
}
43+
44+
if (strncmp(name, fname, len) == 0)
45+
return 1;
46+
5447
return 0;
5548
}
5649

0 commit comments

Comments
 (0)