dm_get_dirattrs can write past end of user buffer

[Kevin Jamieson <kevin@xxxxxxxxxxxxxxxxx>]

I have observed segfaults with an application that calls dm_get_dirattrs
with the latest DMAPI kernel built from SGI CVS.

The problem appears to be in dm_filldir:

        needed = dm_stat_size(namelen + 1);
        ...
        error = -xfs_dm_bulkattr_iget_one(cb->mp, ino, 0,
                statp, needed);
        ...
        /*
         * On return from bulkstat_one(), stap->_link points
         * at the end of the handle in the stat structure.
         */
        statp->dt_compname.vd_offset = statp->_link;
        statp->dt_compname.vd_length = namelen + 1;

xfs_dm_bulkattr_iget_one() sets statp->_link to needed, so the name ends
up getting written past the space reserved for the name, which can
exceed cb->spaceleft.

The below patch appears to fix the problem.


Index: fs/xfs/dmapi/xfs_dm.c
===================================================================
RCS file: /cvs/linux-2.6-xfs/fs/xfs/dmapi/xfs_dm.c,v
retrieving revision 1.81
diff -u -r1.81 xfs_dm.c
--- fs/xfs/dmapi/xfs_dm.c       28 Oct 2008 05:39:09 -0000      1.81
+++ fs/xfs/dmapi/xfs_dm.c       31 Jan 2009 23:08:07 -0000
@@ -1793,7 +1793,7 @@

        memset(statp, 0, dm_stat_size(MAXNAMLEN));
        error = -xfs_dm_bulkattr_iget_one(cb->mp, ino, 0,
-                       statp, needed);
+                       statp, DM_STAT_SIZE(*statp, 0));
        if (error)
                goto out_err;