path: root/security/integrity
diff options
authorDan Carpenter <dan.carpenter@oracle.com>2018-05-29 16:11:28 +0300
committerMimi Zohar <zohar@linux.vnet.ibm.com>2018-05-31 10:13:24 -0400
commita41d80acfa2764e9b1ce49aa303a263e609d91f7 (patch)
tree245f661c84f72a7f4dcb787f798c771971ac79ea /security/integrity
parent72acd64df4561593d2ec3227b4aca9b0d7ded50e (diff)
EVM: prevent array underflow in evm_write_xattrs()
If the user sets xattr->name[0] to NUL then we would read one character before the start of the array. This bug seems harmless as far as I can see but perhaps it would trigger a warning in KASAN. Fixes: fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Diffstat (limited to 'security/integrity')
1 files changed, 1 insertions, 1 deletions
diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
index cf5cd303d7c0..3cefef3919e5 100644
--- a/security/integrity/evm/evm_secfs.c
+++ b/security/integrity/evm/evm_secfs.c
@@ -209,7 +209,7 @@ static ssize_t evm_write_xattrs(struct file *file, const char __user *buf,
/* Remove any trailing newline */
len = strlen(xattr->name);
- if (xattr->name[len-1] == '\n')
+ if (len && xattr->name[len-1] == '\n')
xattr->name[len-1] = '\0';
if (strcmp(xattr->name, ".") == 0) {