afs: Fix characters allowed into cell names
commit a45ea48e2bcd92c1f678b794f488ca0bda9835b8 upstream. The afs filesystem needs to prohibit certain characters from cell names, such as '/', as these are used to form filenames in procfs, leading to the following warning being generated: WARNING: CPU: 0 PID: 3489 at fs/proc/generic.c:178 Fix afs_alloc_cell() to disallow nonprintable characters, '/', '@' and names that begin with a dot. Remove the check for "@cell" as that is then redundant. This can be tested by running: echo add foo/.bar 1.2.3.4 >/proc/fs/afs/cells Note that we will also need to deal with: - Names ending in ".invalid" shouldn't be passed to the DNS. - Names that contain non-valid domainname chars shouldn't be passed to the DNS. - DNS replies that say "your-dns-needs-immediate-attention.<gTLD>" and replies containing A records that say 127.0.53.53 should be considered invalid. [https://www.icann.org/en/system/files/files/name-collision-mitigation-01aug14-en.pdf] but these need to be dealt with by the kafs-client DNS program rather than the kernel. Reported-by: syzbot+b904ba7c947a37b4b291@syzkaller.appspotmail.com Cc: stable@kernel.org Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
8f50a05dd6
commit
881c9706eb
1 changed files with 10 additions and 1 deletions
|
@ -135,8 +135,17 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net,
|
|||
_leave(" = -ENAMETOOLONG");
|
||||
return ERR_PTR(-ENAMETOOLONG);
|
||||
}
|
||||
if (namelen == 5 && memcmp(name, "@cell", 5) == 0)
|
||||
|
||||
/* Prohibit cell names that contain unprintable chars, '/' and '@' or
|
||||
* that begin with a dot. This also precludes "@cell".
|
||||
*/
|
||||
if (name[0] == '.')
|
||||
return ERR_PTR(-EINVAL);
|
||||
for (i = 0; i < namelen; i++) {
|
||||
char ch = name[i];
|
||||
if (!isprint(ch) || ch == '/' || ch == '@')
|
||||
return ERR_PTR(-EINVAL);
|
||||
}
|
||||
|
||||
_enter("%*.*s,%s", namelen, namelen, name, vllist);
|
||||
|
||||
|
|
Loading…
Reference in a new issue