9pfs: check the size of transport buffer before marshaling
v9fs_do_readdir_with_stat() should check for a maximum buffer size before an attempt to marshal gathered data. Otherwise, buffers assumed as misconfigured and the transport would be broken. The patch brings v9fs_do_readdir_with_stat() in conformity with v9fs_do_readdir() behavior. Signed-off-by: Jan Dakinevich <jan.dakinevich@gmail.com> [groug, regression caused my commitstable-2.108d37de41ca
# 2.10] Signed-off-by: Greg Kurz <groug@kaod.org> (cherry picked from commit772a73692e
) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
parent
d13a0bde83
commit
a83858fdb5
19
hw/9pfs/9p.c
19
hw/9pfs/9p.c
|
@ -1750,18 +1750,27 @@ static int coroutine_fn v9fs_do_readdir_with_stat(V9fsPDU *pdu,
|
|||
if (err < 0) {
|
||||
break;
|
||||
}
|
||||
/* 11 = 7 + 4 (7 = start offset, 4 = space for storing count) */
|
||||
len = pdu_marshal(pdu, 11 + count, "S", &v9stat);
|
||||
if ((count + v9stat.size + 2) > max_count) {
|
||||
v9fs_readdir_unlock(&fidp->fs.dir);
|
||||
|
||||
v9fs_readdir_unlock(&fidp->fs.dir);
|
||||
|
||||
if ((len != (v9stat.size + 2)) || ((count + len) > max_count)) {
|
||||
/* Ran out of buffer. Set dir back to old position and return */
|
||||
v9fs_co_seekdir(pdu, fidp, saved_dir_pos);
|
||||
v9fs_stat_free(&v9stat);
|
||||
v9fs_path_free(&path);
|
||||
return count;
|
||||
}
|
||||
|
||||
/* 11 = 7 + 4 (7 = start offset, 4 = space for storing count) */
|
||||
len = pdu_marshal(pdu, 11 + count, "S", &v9stat);
|
||||
|
||||
v9fs_readdir_unlock(&fidp->fs.dir);
|
||||
|
||||
if (len < 0) {
|
||||
v9fs_co_seekdir(pdu, fidp, saved_dir_pos);
|
||||
v9fs_stat_free(&v9stat);
|
||||
v9fs_path_free(&path);
|
||||
return len;
|
||||
}
|
||||
count += len;
|
||||
v9fs_stat_free(&v9stat);
|
||||
v9fs_path_free(&path);
|
||||
|
|
Loading…
Reference in New Issue