afs: Fix storage of cell names

The cell name stored in the afs_cell struct is a 64-char + NUL buffer -
when it needs to be able to handle up to AFS_MAXCELLNAME (256 chars) + NUL.

Fix this by changing the array to a pointer and allocating the string.

Found using Coverity.

Fixes: 989782dcdc91 ("afs: Overhaul cell database management")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/afs/cell.c b/fs/afs/cell.c
index 005921e..5b79cdc 100644 (file)
--- a/fs/afs/cell.c
+++ b/fs/afs/cell.c
@@ -154,10 +154,17 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net,
                return ERR_PTR(-ENOMEM);
        }
 
+       cell->name = kmalloc(namelen + 1, GFP_KERNEL);
+       if (!cell->name) {
+               kfree(cell);
+               return ERR_PTR(-ENOMEM);
+       }
+
        cell->net = net;
        cell->name_len = namelen;
        for (i = 0; i < namelen; i++)
                cell->name[i] = tolower(name[i]);
+       cell->name[i] = 0;
 
        atomic_set(&cell->usage, 2);
        INIT_WORK(&cell->manager, afs_manage_cell);
@@ -207,6 +214,7 @@ parse_failed:
        if (ret == -EINVAL)
                printk(KERN_ERR "kAFS: bad VL server IP address\n");
 error:
+       kfree(cell->name);
        kfree(cell);
        _leave(" = %d", ret);
        return ERR_PTR(ret);
@@ -489,6 +497,7 @@ static void afs_cell_destroy(struct rcu_head *rcu)
        afs_put_vlserverlist(cell->net, rcu_access_pointer(cell->vl_servers));
        afs_put_cell(cell->net, cell->alias_of);
        key_put(cell->anonymous_key);
+       kfree(cell->name);
        kfree(cell);
 
        _leave(" [destroyed]");

diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index d520535..792ac71 100644 (file)
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -388,7 +388,7 @@ struct afs_cell {
        struct afs_vlserver_list __rcu *vl_servers;
 
        u8                      name_len;       /* Length of name */
-       char                    name[64 + 1];   /* Cell name, case-flattened and NUL-padded */
+       char                    *name;          /* Cell name, case-flattened and NUL-padded */
 };
 
 /*