From e501cd28147540d096dd97867b0425a1ef503336 Mon Sep 17 00:00:00 2001 From: Daniel Rosenberg Date: Tue, 15 Feb 2022 15:57:14 -0800 Subject: [PATCH] UPSTREAM: ANDROID: fuse-bpf: Fix filldir filldir used strcpy, potentially leading to writing the ending null past the current page. fuse_dirents are not null terminated, so we switch to using memcpy to avoid adding an extraneous null, which would be overwritten if the name was already byte aligned. Bug: 217570523 Test: generic/027 Signed-off-by: Daniel Rosenberg Change-Id: Ic5d1f1887a113e1a3319998bad47cfbac3d90baa --- fs/fuse/backing.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/fuse/backing.c b/fs/fuse/backing.c index ae4eb9d66781..e2c31647307f 100644 --- a/fs/fuse/backing.c +++ b/fs/fuse/backing.c @@ -191,7 +191,8 @@ void *fuse_open_finalize(struct fuse_args *fa, struct fuse_file *ff = file->private_data; struct fuse_open_out *foo = fa->out_args[0].value; - ff->fh = foo->fh; + if (ff) + ff->fh = foo->fh; return 0; } @@ -1987,7 +1988,7 @@ static int filldir(struct dir_context *ctx, const char *name, int namelen, .type = d_type, }; - strcpy(fd->name, name); + memcpy(fd->name, name, namelen); ec->offset += FUSE_DIRENT_SIZE(fd); return 0;