From ef58bccab7c7ef34451aa4ceea39545ef126b666 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Fri, 25 Jan 2008 23:22:26 -0500 Subject: dlm: make find_rsb() fail gracefully when namelen is too large We *can* get there from receive_request() and dlm_recover_master_copy() with namelen too large if incoming request is invalid; BUG() from DLM_ASSERT() in allocate_rsb() is a bit excessive reaction to that and in case of dlm_recover_master_copy() we would actually oops before that while calculating hash of up to 64Kb worth of data - with data actually being 64 _bytes_ in kmalloc()'ed struct. Signed-off-by: Al Viro Signed-off-by: David Teigland --- fs/dlm/lock.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'fs/dlm/lock.c') diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index 0593dd81d46d..6d98cf9d043d 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -436,11 +436,15 @@ static int find_rsb(struct dlm_ls *ls, char *name, int namelen, { struct dlm_rsb *r, *tmp; uint32_t hash, bucket; - int error = 0; + int error = -EINVAL; + + if (namelen > DLM_RESNAME_MAXLEN) + goto out; if (dlm_no_directory(ls)) flags |= R_CREATE; + error = 0; hash = jhash(name, namelen, 0); bucket = hash & (ls->ls_rsbtbl_size - 1); -- cgit v1.2.3