diff options
| author | Zhihao Cheng <[email protected]> | 2023-09-23 03:28:59 +0000 |
|---|---|---|
| committer | Richard Weinberger <[email protected]> | 2023-10-28 21:19:08 +0000 |
| commit | 75690493591fe283e4c92a3ba7c4420e9858abdb (patch) | |
| tree | 6a9e05748db7f109e8106e93b9d3bf2824398bf9 /drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | |
| parent | ubi: block: Fix use-after-free in ubiblock_cleanup (diff) | |
| download | kernel-75690493591fe283e4c92a3ba7c4420e9858abdb.tar.gz kernel-75690493591fe283e4c92a3ba7c4420e9858abdb.zip | |
ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
The length of dentry name is calculated after the raw name is encrypted,
except for ubifs_link(), which could make the size of dir underflow.
Here is a reproducer:
touch $TMP/file
mkdir $TMP/dir
stat $TMP/dir
for i in $(seq 1 8)
do
ln $TMP/file $TMP/dir/$i
unlink $TMP/dir/$i
done
stat $TMP/dir
The size of dir will be underflow(-96).
Fix it by calculating dentry name's length after the name is encrypted.
Fixes: f4f61d2cc6d8 ("ubifs: Implement encrypted filenames")
Reported-by: Roland Ruckerbauer <[email protected]>
Link: https://lore.kernel.org/linux-mtd/[email protected]/T/#u
Signed-off-by: Zhihao Cheng <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c')
0 files changed, 0 insertions, 0 deletions
