]> git.itanic.dy.fi Git - linux-stable/commit
f2fs: avoid utf8_strncasecmp() with unstable name
authorEric Biggers <ebiggers@google.com>
Mon, 1 Jun 2020 20:08:05 +0000 (13:08 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 24 Jun 2020 15:49:21 +0000 (17:49 +0200)
commit293aab21a060d9db8f6f493ed3afdf930c15653a
treeb62451f740a7e43b2879d0fd71111f77f137bcdc
parentf526af054c18bb5bc5944b8551d25394bd02bc68
f2fs: avoid utf8_strncasecmp() with unstable name

[ Upstream commit fc3bb095ab02b9e7d89a069ade2cead15c64c504 ]

If the dentry name passed to ->d_compare() fits in dentry::d_iname, then
it may be concurrently modified by a rename.  This can cause undefined
behavior (possibly out-of-bounds memory accesses or crashes) in
utf8_strncasecmp(), since fs/unicode/ isn't written to handle strings
that may be concurrently modified.

Fix this by first copying the filename to a stack buffer if needed.
This way we get a stable snapshot of the filename.

Fixes: 2c2eb7a300cd ("f2fs: Support case-insensitive file name lookups")
Cc: <stable@vger.kernel.org> # v5.4+
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Daniel Rosenberg <drosen@google.com>
Cc: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/f2fs/dir.c