mirror of
https://git.openafs.org/openafs.git
synced 2025-01-31 05:27:44 +00:00
LINUX: Use afs_convert_code in afs_notify_change
afs_notify_change currently just returns "-code". This can cause a panic if the error code is negative, since we will return a positive error code, which may get interpreted as a valid pointer value in higher levels. Specifically, if we hit afs_notify_change via something like this code path: do_sys_open -> do_filp_open -> open_namei -> may_open -> do_truncate -> notify_change -> afs_notify_change (via inode->i_op->setattr) the positive error value will be interpreted by do_sys_open as a valid 'struct file' pointer, and will be dereferenced. So pass the return value through afs_convert_code, like all of the other vnode ops, so we ensure we return an error properly. Change-Id: I941cc2d77d5a96cf86dfe133d30af4ccf6e9f2cb Reviewed-on: http://gerrit.openafs.org/6776 Reviewed-by: Derrick Brashear <shadow@dementix.org> Tested-by: BuildBot <buildbot@rampaginggeek.com>
This commit is contained in:
parent
620d4169b7
commit
634c6f184b
@ -960,7 +960,7 @@ afs_notify_change(struct dentry *dp, struct iattr *iattrp)
|
||||
}
|
||||
AFS_GUNLOCK();
|
||||
crfree(credp);
|
||||
return -code;
|
||||
return afs_convert_code(code);
|
||||
}
|
||||
|
||||
static int
|
||||
|
@ -964,7 +964,7 @@ afs_notify_change(struct dentry *dp, struct iattr *iattrp)
|
||||
}
|
||||
AFS_GUNLOCK();
|
||||
crfree(credp);
|
||||
return -code;
|
||||
return afs_convert_code(code);
|
||||
}
|
||||
|
||||
/* Validate a dentry. Return 1 if unchanged, 0 if VFS layer should re-evaluate.
|
||||
|
Loading…
x
Reference in New Issue
Block a user