Skip to content
  • Eric Biggers's avatar
    f2fs: avoid utf8_strncasecmp() with unstable name · fc3bb095
    Eric Biggers authored
    If the dentry name passed to ->d_compare() fits in dentry::d_iname, then
    it may be concurrently modified by a rename.  This can cause undefined
    behavior (possibly out-of-bounds memory accesses or crashes) in
    utf8_strncasecmp(), since fs/unicode/ isn't written to handle strings
    that may be concurrently modified.
    
    Fix this by first copying the filename to a stack buffer if needed.
    This way we get a stable snapshot of the filename.
    
    Fixes: 2c2eb7a3
    
     ("f2fs: Support case-insensitive file name lookups")
    Cc: <stable@vger.kernel.org> # v5.4+
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Daniel Rosenberg <drosen@google.com>
    Cc: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    fc3bb095