git.openpandora.org / pandora-kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: f230077) | patch
xfs: underflow bug in xfs_attrlist_by_handle()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 31 Oct 2013 18:00:10 +0000 (21:00 +0300)
committerBen Myers <bpm@sgi.com>
Wed, 4 Dec 2013 20:23:46 +0000 (14:23 -0600)
commit071c529eb672648ee8ca3f90944bcbcc730b4c06
treecd7b38fd97a14db125f3181131c31fda84f2690atree | snapshot
parentf23007784570278ca5963c35d5b3847d710ed695commit | diff
xfs: underflow bug in xfs_attrlist_by_handle()

If we allocate less than sizeof(struct attrlist) then we end up
corrupting memory or doing a ZERO_PTR_SIZE dereference.

This can only be triggered with CAP_SYS_ADMIN.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
fs/xfs/xfs_ioctl.c diff | blob | history
fs/xfs/xfs_ioctl32.c diff | blob | history
Pandora Kernel Repository