Skip to content

Commit 60a6002

Browse files
author
Al Viro
committed
hostfs: fix string handling in __dentry_name()
strcpy() should not be used with destination potentially overlapping the source; what's more, strscpy() in there is pointless - we already know the amount we want to copy; might as well use memcpy(). Fixes: c278e81 "hostfs: Remove open coded strcpy()" Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
1 parent 40384c8 commit 60a6002

File tree

1 file changed

+6
-21
lines changed

1 file changed

+6
-21
lines changed

fs/hostfs/hostfs_kern.c

Lines changed: 6 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -95,32 +95,17 @@ __uml_setup("hostfs=", hostfs_args,
9595
static char *__dentry_name(struct dentry *dentry, char *name)
9696
{
9797
char *p = dentry_path_raw(dentry, name, PATH_MAX);
98-
char *root;
99-
size_t len;
100-
struct hostfs_fs_info *fsi;
101-
102-
fsi = dentry->d_sb->s_fs_info;
103-
root = fsi->host_root_path;
104-
len = strlen(root);
105-
if (IS_ERR(p)) {
106-
__putname(name);
107-
return NULL;
108-
}
109-
110-
/*
111-
* This function relies on the fact that dentry_path_raw() will place
112-
* the path name at the end of the provided buffer.
113-
*/
114-
BUG_ON(p + strlen(p) + 1 != name + PATH_MAX);
98+
struct hostfs_fs_info *fsi = dentry->d_sb->s_fs_info;
99+
char *root = fsi->host_root_path;
100+
size_t len = strlen(root);
115101

116-
strscpy(name, root, PATH_MAX);
117-
if (len > p - name) {
102+
if (IS_ERR(p) || len > p - name) {
118103
__putname(name);
119104
return NULL;
120105
}
121106

122-
if (p > name + len)
123-
strcpy(name + len, p);
107+
memcpy(name, root, len);
108+
memmove(name + len, p, name + PATH_MAX - p);
124109

125110
return name;
126111
}

0 commit comments

Comments
 (0)