Skip to content

Commit e825196

Browse files
author
Al Viro
committed
make prepend_name() work correctly when called with negative *buflen
In all callchains leading to prepend_name(), the value left in *buflen is eventually discarded unused if prepend_name() has returned a negative. So we are free to do what prepend() does, and subtract from *buflen *before* checking for underflow (which turns into checking the sign of subtraction result, of course). Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
1 parent 99aea68 commit e825196

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

fs/dcache.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2833,9 +2833,9 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name)
28332833
u32 dlen = ACCESS_ONCE(name->len);
28342834
char *p;
28352835

2836-
if (*buflen < dlen + 1)
2837-
return -ENAMETOOLONG;
28382836
*buflen -= dlen + 1;
2837+
if (*buflen < 0)
2838+
return -ENAMETOOLONG;
28392839
p = *buffer -= dlen + 1;
28402840
*p++ = '/';
28412841
while (dlen--) {

0 commit comments

Comments
 (0)