diff options
| author | Andrey Ryabinin <aryabinin@virtuozzo.com> | 2018-02-01 21:00:51 +0300 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2018-02-01 12:20:21 -0800 |
| commit | bfe7aa6c39b12a6ab1e95f50271c53e47d6dd060 (patch) | |
| tree | 9ed9553b19b251b34f55da97aaf4c43fec7abb9c /fs/dcache.c | |
| parent | 1a3241ff10d038ecd096d03380327f2a0b5840a6 (diff) | |
| download | linux-0-day-bfe7aa6c39b12a6ab1e95f50271c53e47d6dd060.tar.gz linux-0-day-bfe7aa6c39b12a6ab1e95f50271c53e47d6dd060.tar.xz | |
fs/dcache: Use read_word_at_a_time() in dentry_string_cmp()
dentry_string_cmp() performs the word-at-a-time reads from 'cs' and may
read slightly more than it was requested in kmallac(). Normally this
would make KASAN to report out-of-bounds access, but this was
workarounded by commit df4c0e36f1b1 ("fs: dcache: manually unpoison
dname after allocation to shut up kasan's reports").
This workaround is not perfect, since it allows out-of-bounds access to
dentry's name for all the code, not just in dentry_string_cmp().
So it would be better to use read_word_at_a_time() instead and revert
commit df4c0e36f1b1.
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/dcache.c')
| -rw-r--r-- | fs/dcache.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/dcache.c b/fs/dcache.c index 5c7df1df81ff8..7fd39f4c5a726 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -195,7 +195,7 @@ static inline int dentry_string_cmp(const unsigned char *cs, const unsigned char unsigned long a,b,mask; for (;;) { - a = *(unsigned long *)cs; + a = read_word_at_a_time(cs); b = load_unaligned_zeropad(ct); if (tcount < sizeof(unsigned long)) break; |