Skip to content

Commit 12eb22a

Browse files
committed
ceph: validate snapdirname option length when mounting
It becomes a path component, so it shouldn't exceed NAME_MAX characters. This was hardened in commit c152737 ("ceph: Use strscpy() instead of strcpy() in __get_snap_name()"), but no actual check was put in place. Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Alex Markuze <amarkuze@redhat.com>
1 parent 550f7ca commit 12eb22a

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

fs/ceph/super.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -431,6 +431,8 @@ static int ceph_parse_mount_param(struct fs_context *fc,
431431

432432
switch (token) {
433433
case Opt_snapdirname:
434+
if (strlen(param->string) > NAME_MAX)
435+
return invalfc(fc, "snapdirname too long");
434436
kfree(fsopt->snapdir_name);
435437
fsopt->snapdir_name = param->string;
436438
param->string = NULL;

0 commit comments

Comments
 (0)