diff options
| author | HyungJung Joo <jhj140711@gmail.com> | 2026-03-13 15:34:44 +0900 |
|---|---|---|
| committer | Mike Marshall <hubcap@omnibond.com> | 2026-04-07 11:28:19 -0400 |
| commit | 092e0d0e964279feb9f43f81e8d1c52ef080d085 (patch) | |
| tree | 20b7dfe812788387fa954af0c1b0284035486121 /rust/kernel/alloc/allocator | |
| parent | 415e507cdefc510c01de8ab6644163327ee9a5d0 (diff) | |
orangefs: validate getxattr response length
orangefs_inode_getxattr() trusts the userspace-client-controlled
downcall.resp.getxattr.val_sz and uses it as a memcpy() length
both for the temporary user buffer and the cached xattr buffer.
Reject malformed negative or oversized lengths before copying
response bytes.
Reported-by: Hyungjung Joo <jhj140711@gmail.com>
Signed-off-by: HyungJung Joo <jhj140711@gmail.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Diffstat (limited to 'rust/kernel/alloc/allocator')
0 files changed, 0 insertions, 0 deletions