f2fs: avoid utf8_strncasecmp() with unstable name
authorEric Biggers <ebiggers@google.com>
Mon, 1 Jun 2020 20:08:05 +0000 (13:08 -0700)
committerJaegeuk Kim <jaegeuk@kernel.org>
Tue, 9 Jun 2020 03:37:53 +0000 (20:37 -0700)
commitfc3bb095ab02b9e7d89a069ade2cead15c64c504
treedf6dd9f4f8b6594b8342f111a28a97070953f03d
parent0b6d4ca04a86b9dababbb76e58d33c437e127b77
f2fs: avoid utf8_strncasecmp() with unstable name

If the dentry name passed to ->d_compare() fits in dentry::d_iname, then
it may be concurrently modified by a rename.  This can cause undefined
behavior (possibly out-of-bounds memory accesses or crashes) in
utf8_strncasecmp(), since fs/unicode/ isn't written to handle strings
that may be concurrently modified.

Fix this by first copying the filename to a stack buffer if needed.
This way we get a stable snapshot of the filename.

Fixes: 2c2eb7a300cd ("f2fs: Support case-insensitive file name lookups")
Cc: <stable@vger.kernel.org> # v5.4+
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Daniel Rosenberg <drosen@google.com>
Cc: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
fs/f2fs/dir.c