@@ -586,6 +586,17 @@ vfs_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,
586586}
587587EXPORT_SYMBOL_GPL (vfs_removexattr );
588588
589+ int import_xattr_name (struct xattr_name * kname , const char __user * name )
590+ {
591+ int error = strncpy_from_user (kname -> name , name ,
592+ sizeof (kname -> name ));
593+ if (error == 0 || error == sizeof (kname -> name ))
594+ return - ERANGE ;
595+ if (error < 0 )
596+ return error ;
597+ return 0 ;
598+ }
599+
589600/*
590601 * Extended attribute SET operations
591602 */
@@ -597,14 +608,10 @@ int setxattr_copy(const char __user *name, struct kernel_xattr_ctx *ctx)
597608 if (ctx -> flags & ~(XATTR_CREATE |XATTR_REPLACE ))
598609 return - EINVAL ;
599610
600- error = strncpy_from_user (ctx -> kname -> name , name ,
601- sizeof (ctx -> kname -> name ));
602- if (error == 0 || error == sizeof (ctx -> kname -> name ))
603- return - ERANGE ;
604- if (error < 0 )
611+ error = import_xattr_name (ctx -> kname , name );
612+ if (error )
605613 return error ;
606614
607- error = 0 ;
608615 if (ctx -> size ) {
609616 if (ctx -> size > XATTR_SIZE_MAX )
610617 return - E2BIG ;
@@ -763,10 +770,8 @@ getxattr(struct mnt_idmap *idmap, struct dentry *d,
763770 .flags = 0 ,
764771 };
765772
766- error = strncpy_from_user (kname .name , name , sizeof (kname .name ));
767- if (error == 0 || error == sizeof (kname .name ))
768- error = - ERANGE ;
769- if (error < 0 )
773+ error = import_xattr_name (& kname , name );
774+ if (error )
770775 return error ;
771776
772777 error = do_getxattr (idmap , d , & ctx );
@@ -906,20 +911,18 @@ static int path_removexattr(const char __user *pathname,
906911{
907912 struct path path ;
908913 int error ;
909- char kname [ XATTR_NAME_MAX + 1 ] ;
914+ struct xattr_name kname ;
910915
911- error = strncpy_from_user (kname , name , sizeof (kname ));
912- if (error == 0 || error == sizeof (kname ))
913- error = - ERANGE ;
914- if (error < 0 )
916+ error = import_xattr_name (& kname , name );
917+ if (error )
915918 return error ;
916919retry :
917920 error = user_path_at (AT_FDCWD , pathname , lookup_flags , & path );
918921 if (error )
919922 return error ;
920923 error = mnt_want_write (path .mnt );
921924 if (!error ) {
922- error = removexattr (mnt_idmap (path .mnt ), path .dentry , kname );
925+ error = removexattr (mnt_idmap (path .mnt ), path .dentry , kname . name );
923926 mnt_drop_write (path .mnt );
924927 }
925928 path_put (& path );
@@ -945,23 +948,21 @@ SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,
945948SYSCALL_DEFINE2 (fremovexattr , int , fd , const char __user * , name )
946949{
947950 CLASS (fd , f )(fd );
948- char kname [ XATTR_NAME_MAX + 1 ] ;
951+ struct xattr_name kname ;
949952 int error ;
950953
951954 if (fd_empty (f ))
952955 return - EBADF ;
953956 audit_file (fd_file (f ));
954957
955- error = strncpy_from_user (kname , name , sizeof (kname ));
956- if (error == 0 || error == sizeof (kname ))
957- error = - ERANGE ;
958- if (error < 0 )
958+ error = import_xattr_name (& kname , name );
959+ if (error )
959960 return error ;
960961
961962 error = mnt_want_write_file (fd_file (f ));
962963 if (!error ) {
963964 error = removexattr (file_mnt_idmap (fd_file (f )),
964- fd_file (f )-> f_path .dentry , kname );
965+ fd_file (f )-> f_path .dentry , kname . name );
965966 mnt_drop_write_file (fd_file (f ));
966967 }
967968 return error ;
0 commit comments