Skip to content

Commit 12eb22a

Browse files
committed
ceph: validate snapdirname option length when mounting
It becomes a path component, so it shouldn't exceed NAME_MAX characters. This was hardened in commit c152737 ("ceph: Use strscpy() instead of strcpy() in __get_snap_name()"), but no actual check was put in place. Cc: [email protected] Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Alex Markuze <[email protected]>
1 parent 550f7ca commit 12eb22a

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

fs/ceph/super.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -431,6 +431,8 @@ static int ceph_parse_mount_param(struct fs_context *fc,
431431

432432
switch (token) {
433433
case Opt_snapdirname:
434+
if (strlen(param->string) > NAME_MAX)
435+
return invalfc(fc, "snapdirname too long");
434436
kfree(fsopt->snapdir_name);
435437
fsopt->snapdir_name = param->string;
436438
param->string = NULL;

0 commit comments

Comments
 (0)