mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
![]() JFS has in jfs_incore.h: /* _inline may overflow into _inline_ea when needed */ /* _inline_ea may overlay the last part of * file._xtroot if maxentry = XTROOTINITSLOT */ union { struct { /* 128: inline symlink */ unchar _inline[128]; /* 128: inline extended attr */ unchar _inline_ea[128]; }; unchar _inline_all[256]; and currently the symlink code copies into _inline; if this is larger than 128 bytes it triggers a fortify warning of the form: memcpy: detected field-spanning write (size 132) of single field "ip->i_link" at fs/jfs/namei.c:950 (size 18446744073709551615) when it's actually OK. Copy it into _inline_all instead. Reported-by: syzbot+5fc38b2ddbbca7f5c680@syzkaller.appspotmail.com Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> |
||
---|---|---|
.. | ||
acl.c | ||
file.c | ||
inode.c | ||
ioctl.c | ||
jfs_acl.h | ||
jfs_btree.h | ||
jfs_debug.c | ||
jfs_debug.h | ||
jfs_dinode.h | ||
jfs_discard.c | ||
jfs_discard.h | ||
jfs_dmap.c | ||
jfs_dmap.h | ||
jfs_dtree.c | ||
jfs_dtree.h | ||
jfs_extent.c | ||
jfs_extent.h | ||
jfs_filsys.h | ||
jfs_imap.c | ||
jfs_imap.h | ||
jfs_incore.h | ||
jfs_inode.c | ||
jfs_inode.h | ||
jfs_lock.h | ||
jfs_logmgr.c | ||
jfs_logmgr.h | ||
jfs_metapage.c | ||
jfs_metapage.h | ||
jfs_mount.c | ||
jfs_superblock.h | ||
jfs_txnmgr.c | ||
jfs_txnmgr.h | ||
jfs_types.h | ||
jfs_umount.c | ||
jfs_unicode.c | ||
jfs_unicode.h | ||
jfs_uniupr.c | ||
jfs_xattr.h | ||
jfs_xtree.c | ||
jfs_xtree.h | ||
Kconfig | ||
Makefile | ||
namei.c | ||
resize.c | ||
super.c | ||
symlink.c | ||
xattr.c |