mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-04-12 16:47:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

orangefs: fix a oob in orangefs_debug_write

Browse Source 
I got a syzbot report: slab-out-of-bounds Read in
 orangefs_debug_write... several people suggested fixes,
 I tested Al Viro's suggestion and made this patch.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEWLOQAZkv9m2xtUCf/Vh1C1u0YnAFAmeb3RkACgkQ/Vh1C1u0
 YnC/1w//eK8bokOsIuTqav7EF3jYbVYrsB7bV4JBPkLOc8GReh1UGI5ZG7G15cI1
 KlR62OHgJoU5u1pc3MVhwg1J9ylKaSL2V/CtEGTekI+Q10GPigkho7/0j6QSZ4nK
 O9toznlFFVWV2rbNyb7f5YzCrZawO/mhOPWLxVhN2iVWjOYb6QgSMbkrh/T1NFOP
 +LLUdQ+pE+zBhVeS2SAmsuTwCTHni/kmovynA4zFRbaFRCFr8UFcaA/HxFC5Wnia
 liI0ZCTslDLiBPwSuPxJIV9ZDpufuzCP8UomjWA4WPy3kRGrAt/Vpum4Bj4Et5Ek
 F1Du2CaKJ98tpf1yuP6Qo5VFzdqPJudNEUaOVF7philerkf4bwx7e4zDh5Ux+DEU
 dI50eueL94fQ+PKlOe3NwuKzldQCPj8L8j3x33dAJjWDXd8tVMeuxH+w5VVpHj88
 0W2B3YZ21jzOb6CStoaq0JwHZW6Q4HUFupyhHNyAxt8AkmHB1UtOzdYSGVJQGF5w
 gdlQF1fTNoXWnNWhWT8zzPIZS80qcmql2Z628FqvbYa1jJOaNJ7jWstX9hs5/OvU
 sTOsYYHpcSWyrX5rdp377Irbjk0/Mm+WqSqiiZafQZM742pufL2IvLYp4lcq63FO
 ZmvBw82XUVdbBhM9hcXt3FdyeU0cfJ2nYe4LsACV+Qg4JMmN3nM=
 =34Ev
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-6.14-ofs4' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux

Pull orangefs fix from Mike Marshall:
 "Fix a oob in orangefs_debug_write

  I got a syzbot report: "slab-out-of-bounds Read in orangefs_debug_write"

  Several people suggested fixes, I tested Al Viro's suggestion and made
  this patch"

* tag 'for-linus-6.14-ofs4' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
  orangefs: fix a oob in orangefs_debug_write
This commit is contained in:
Linus Torvalds 2025-01-31 09:40:31 -08:00
commit 69b8923f50
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/orangefs/orangefs-debugfs.c
View File

@ -392,9 +392,9 @@ static ssize_t orangefs_debug_write(struct file *file,
* Thwart users who try to jamb a ridiculous number
* of bytes into the debug file...
*/
if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) {
if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) {
silly = count;
count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1;
count = ORANGEFS_MAX_DEBUG_STRING_LEN;
}
buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL);