autofs (< 2.2.1) security fix

H. Peter Anvin (hpa@transmeta.com)
Sat, 20 Feb 1999 19:34:24 -0800 (PST)


This fixes the buffer overrun problem in autofs that was recently
reported.

-hpa

diff -ur stock/linux-2.2.2-pre5/fs/autofs/root.c linux-2.2.2-pre5/fs/autofs/root.c
--- stock/linux-2.2.2-pre5/fs/autofs/root.c Mon Jan 11 15:03:30 1999
+++ linux-2.2.2-pre5/fs/autofs/root.c Sat Feb 20 18:53:53 1999
@@ -209,7 +209,7 @@
NULL, /* d_compare */
};

-static int autofs_root_lookup(struct inode *dir, struct dentry * dentry)
+static int autofs_root_lookup(struct inode *dir, struct dentry *dentry)
{
struct autofs_sb_info *sbi;
int oz_mode;
@@ -220,6 +220,9 @@
if (!S_ISDIR(dir->i_mode))
return -ENOTDIR;

+ if (dentry->d_name.len > NAME_MAX)
+ return -ENOENT; /* File name too long to exist */
+
sbi = autofs_sbi(dir->i_sb);

oz_mode = autofs_oz_mode(sbi);
@@ -280,6 +283,9 @@
if ( !autofs_oz_mode(sbi) )
return -EPERM;

+ if ( dentry->d_name.len > NAME_MAX )
+ return -ENAMETOOLONG;
+
if ( autofs_hash_lookup(dh, &dentry->d_name) )
return -EEXIST;

@@ -400,6 +406,9 @@

if ( !autofs_oz_mode(sbi) )
return -EPERM;
+
+ if ( dentry->d_name.len > NAME_MAX )
+ return -ENAMETOOLONG;

ent = autofs_hash_lookup(dh, &dentry->d_name);
if ( ent )
diff -ur stock/linux-2.2.2-pre5/fs/autofs/waitq.c linux-2.2.2-pre5/fs/autofs/waitq.c
--- stock/linux-2.2.2-pre5/fs/autofs/waitq.c Mon Jan 11 15:03:30 1999
+++ linux-2.2.2-pre5/fs/autofs/waitq.c Sat Feb 20 19:26:21 1999
@@ -99,13 +99,17 @@
autofs_catatonic_mode(sbi);
}

-int autofs_wait(struct autofs_sb_info *sbi, struct qstr * name)
+int autofs_wait(struct autofs_sb_info *sbi, struct qstr *name)
{
struct autofs_wait_queue *wq;
int status;

/* In catatonic mode, we don't wait for nobody */
if ( sbi->catatonic )
+ return -ENOENT;
+
+ /* We shouldn't be able to get here, but just in case */
+ if ( name->len > NAME_MAX )
return -ENOENT;

for ( wq = sbi->queues ; wq ; wq = wq->next ) {

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/