Skip to content

Commit dd07bb8

Browse files
author
Darrick J. Wong
committed
xfs: revert commit 8954c44
The name passed into __xfs_xattr_put_listent is exactly namelen bytes long and not null-terminated. Passing namelen+1 to the strscpy function strscpy(offset, (char *)name, namelen + 1); is therefore wrong. Go back to the old code, which works fine because strncpy won't find a null in @name and stops after namelen bytes. It really could be a memcpy call, but it worked for years. Reported-by: [email protected] Fixes: 8954c44 ("xfs: use strscpy() to instead of strncpy()") Signed-off-by: Darrick J. Wong <[email protected]>
1 parent 2ee8333 commit dd07bb8

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

fs/xfs/xfs_xattr.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,9 @@ __xfs_xattr_put_listent(
212212
offset = context->buffer + context->count;
213213
memcpy(offset, prefix, prefix_len);
214214
offset += prefix_len;
215-
strscpy(offset, (char *)name, namelen + 1); /* real name */
215+
strncpy(offset, (char *)name, namelen); /* real name */
216+
offset += namelen;
217+
*offset = '\0';
216218

217219
compute_size:
218220
context->count += prefix_len + namelen + 1;

0 commit comments

Comments
 (0)