linux-kernel - [PATCH] nfs: Fix listxattr regression

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1449836146-5674-1-git-send-email-agruenba@redhat.com>
Date:	Fri, 11 Dec 2015 13:15:46 +0100
From:	Andreas Gruenbacher <agruenba@...hat.com>
To:	Alexander Viro <viro@...iv.linux.org.uk>,
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org
Cc:	Andreas Gruenbacher <agruenba@...hat.com>
Subject: [PATCH] nfs: Fix listxattr regression

Al,

the xattr cleanup patches which are meanwhile in your for-next branch broke
listxattr on nfs.  Could you please add this fix?

Thanks,
Andreas

--

In removing the list operation of nfs4_xattr_nfs4_label_handler, commit
d77ae742 has introduced a NULL pointer dereference in generic_listxattr.
Fix by checking for NULL list operations.  In addition, skip prefix (as
opposed to full-name) xattr handlers there: listing a prefix is not
meaningful.

Signed-off-by: Andreas Gruenbacher <agruenba@...hat.com>
---
 fs/xattr.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/xattr.c b/fs/xattr.c
index bfd4a85..477bda2 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -723,15 +723,18 @@ generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
 
 	if (!buffer) {
 		for_each_xattr_handler(handlers, handler) {
-			if (handler->list(dentry))
-				size += strlen(handler->name) + 1;
+			if (!handler->name ||
+			    (handler->list && !handler->list(dentry)))
+				continue;
+			size += strlen(handler->name) + 1;
 		}
 	} else {
 		char *buf = buffer;
 		size_t len;
 
 		for_each_xattr_handler(handlers, handler) {
-			if (!handler->list(dentry))
+			if (!handler->name ||
+			    (handler->list && !handler->list(dentry)))
 				continue;
 			len = strlen(handler->name);
 			if (len + 1 > buffer_size)
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/