Reading a symlink longer than the given buffer, a p9_debug use would
try to print the link name (not NUL-terminated) using a %s format.
Use %.*s instead, and replace the strncpy+strnlen with functionally
equivalent strlen+memcpy.

Signed-off-by: Jim Meyering <meyer...@redhat.com>
---
V1 provoked a warning due to strlen/buflen type differences (size_t/int)
and the "min" macro's type equality requirement.  This adds a cast to
avoid that warning:

-       retval = min(strlen(st->extension)+1, buflen);
+       retval = min(strlen(st->extension)+1, (size_t)buflen);

 fs/9p/vfs_inode.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index cbf9dbb..890bed5 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -1276,12 +1276,12 @@ static int v9fs_readlink(struct dentry *dentry, char 
*buffer, int buflen)
        }

        /* copy extension buffer into buffer */
-       strncpy(buffer, st->extension, buflen);
+       retval = min(strlen(st->extension)+1, (size_t)buflen);
+       memcpy(buffer, st->extension, retval);

-       p9_debug(P9_DEBUG_VFS, "%s -> %s (%s)\n",
-                dentry->d_name.name, st->extension, buffer);
+       p9_debug(P9_DEBUG_VFS, "%s -> %s (%.*s)\n",
+                dentry->d_name.name, st->extension, buflen, buffer);

-       retval = strnlen(buffer, buflen);
 done:
        p9stat_free(st);
        kfree(st);
--
1.7.12
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to