Commit ef1f7a7e authored by Bernd Schmidt's avatar Bernd Schmidt Committed by Linus Torvalds

ROMFS: fix length used with romfs_dev_strnlen() function

An interestingly corrupted romfs file system exposed a problem with the
romfs_dev_strnlen function: it's passing the wrong value to its helpers.
Rather than limit the string to the length passed in by the callers, it
uses the size of the device as the limit.
Signed-off-by: default avatarBernd Schmidt <bernds_cb1@t-online.de>
Signed-off-by: default avatarMike Frysinger <vapier@gentoo.org>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c6c59927
...@@ -253,11 +253,11 @@ ssize_t romfs_dev_strnlen(struct super_block *sb, ...@@ -253,11 +253,11 @@ ssize_t romfs_dev_strnlen(struct super_block *sb,
#ifdef CONFIG_ROMFS_ON_MTD #ifdef CONFIG_ROMFS_ON_MTD
if (sb->s_mtd) if (sb->s_mtd)
return romfs_mtd_strnlen(sb, pos, limit); return romfs_mtd_strnlen(sb, pos, maxlen);
#endif #endif
#ifdef CONFIG_ROMFS_ON_BLOCK #ifdef CONFIG_ROMFS_ON_BLOCK
if (sb->s_bdev) if (sb->s_bdev)
return romfs_blk_strnlen(sb, pos, limit); return romfs_blk_strnlen(sb, pos, maxlen);
#endif #endif
return -EIO; return -EIO;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment