befs: Validate length of long symbolic links, CVE-2011-2928

[linux-flexiantxendom0-natty.git] / fs / befs / linuxvfs.c

diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 615d549..e8ff0d7 100644 (file)
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -284,12 +284,18 @@ befs_alloc_inode(struct super_block *sb)
         return &bi->vfs_inode;
 }
 
-static void
-befs_destroy_inode(struct inode *inode)
+static void befs_i_callback(struct rcu_head *head)
 {
+       struct inode *inode = container_of(head, struct inode, i_rcu);
+       INIT_LIST_HEAD(&inode->i_dentry);
         kmem_cache_free(befs_inode_cachep, BEFS_I(inode));
 }
 
+static void befs_destroy_inode(struct inode *inode)
+{
+       call_rcu(&inode->i_rcu, befs_i_callback);
+}
+
 static void init_once(void *foo)
 {
         struct befs_inode_info *bi = (struct befs_inode_info *) foo;
@@ -384,7 +390,7 @@ static struct inode *befs_iget(struct super_block *sb, unsigned long ino)
                int num_blks;
 
                befs_ino->i_data.ds =
-                   fsds_to_cpu(sb, raw_inode->data.datastream);
+                   fsds_to_cpu(sb, &raw_inode->data.datastream);
 
                num_blks = befs_count_blocks(sb, &befs_ino->i_data.ds);
                inode->i_blocks =
@@ -436,7 +442,7 @@ befs_init_inodecache(void)
                                              init_once);
        if (befs_inode_cachep == NULL) {
                printk(KERN_ERR "befs_init_inodecache: "
-                      "Couldn't initalize inode slabcache\n");
+                      "Couldn't initialize inode slabcache\n");
                return -ENOMEM;
        }
 
@@ -469,17 +475,22 @@ befs_follow_link(struct dentry *dentry, struct nameidata *nd)
                befs_data_stream *data = &befs_ino->i_data.ds;
                befs_off_t len = data->size;
 
-               befs_debug(sb, "Follow long symlink");
-
-               link = kmalloc(len, GFP_NOFS);
-               if (!link) {
-                       link = ERR_PTR(-ENOMEM);
-               } else if (befs_read_lsymlink(sb, data, link, len) != len) {
-                       kfree(link);
-                       befs_error(sb, "Failed to read entire long symlink");
+               if (len == 0) {
+                       befs_error(sb, "Long symlink with illegal length");
                        link = ERR_PTR(-EIO);
                } else {
-                       link[len - 1] = '\0';
+                       befs_debug(sb, "Follow long symlink");
+
+                       link = kmalloc(len, GFP_NOFS);
+                       if (!link) {
+                               link = ERR_PTR(-ENOMEM);
+                       } else if (befs_read_lsymlink(sb, data, link, len) != len) {
+                               kfree(link);
+                               befs_error(sb, "Failed to read entire long symlink");
+                               link = ERR_PTR(-EIO);
+                       } else {
+                               link[len - 1] = '\0';
+                       }
                }
        } else {
                link = befs_ino->i_data.symlink;
@@ -737,12 +748,7 @@ befs_put_super(struct super_block *sb)
 {
        kfree(BEFS_SB(sb)->mount_opts.iocharset);
        BEFS_SB(sb)->mount_opts.iocharset = NULL;
-
-       if (BEFS_SB(sb)->nls) {
-               unload_nls(BEFS_SB(sb)->nls);
-               BEFS_SB(sb)->nls = NULL;
-       }
-
+       unload_nls(BEFS_SB(sb)->nls);
        kfree(sb->s_fs_info);
        sb->s_fs_info = NULL;
 }
@@ -842,7 +848,7 @@ befs_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_magic = BEFS_SUPER_MAGIC;
        /* Set real blocksize of fs */
        sb_set_blocksize(sb, (ulong) befs_sb->block_size);
-       sb->s_op = (struct super_operations *) &befs_sops;
+       sb->s_op = &befs_sops;
        root = befs_iget(sb, iaddr2blockno(sb, &(befs_sb->root_dir)));
        if (IS_ERR(root)) {
                ret = PTR_ERR(root);
@@ -878,6 +884,7 @@ befs_fill_super(struct super_block *sb, void *data, int silent)
        brelse(bh);
 
       unacquire_priv_sbp:
+       kfree(befs_sb->mount_opts.iocharset);
        kfree(sb->s_fs_info);
 
       unacquire_none:
@@ -917,18 +924,17 @@ befs_statfs(struct dentry *dentry, struct kstatfs *buf)
        return 0;
 }
 
-static int
-befs_get_sb(struct file_system_type *fs_type, int flags, const char *dev_name,
-           void *data, struct vfsmount *mnt)
+static struct dentry *
+befs_mount(struct file_system_type *fs_type, int flags, const char *dev_name,
+           void *data)
 {
-       return get_sb_bdev(fs_type, flags, dev_name, data, befs_fill_super,
-                          mnt);
+       return mount_bdev(fs_type, flags, dev_name, data, befs_fill_super);
 }
 
 static struct file_system_type befs_fs_type = {
        .owner          = THIS_MODULE,
        .name           = "befs",
-       .get_sb         = befs_get_sb,
+       .mount          = befs_mount,
        .kill_sb        = kill_block_super,
        .fs_flags       = FS_REQUIRES_DEV,      
 };