From: Miklos Szeredi <miklos@szeredi.hu>
Date: Tue, 10 Nov 2015 16:08:41 +0000 (+0100)
Subject: ovl: allow zero size xattr
X-Git-Tag: v4.1.12-107.0.20170801_2000~11
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=c9bb79cb1ac0ce170c8a63c3224fb06582146aba;p=users%2Fjedix%2Flinux-maple.git

ovl: allow zero size xattr

Orabug: 26546379, 26540706
CVE-2016-1575
CVE-2016-1576

When ovl_copy_xattr() encountered a zero size xattr no more xattrs were
copied and the function returned success.  This is clearly not the desired
behavior.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Cc: <stable@vger.kernel.org>
(cherry picked from commit 97daf8b97ad6f913a34c82515be64dc9ac08d63e)
Signed-off-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
---

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 2927d18ff436..247bce0ad4a9 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -54,7 +54,7 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
 
 	for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
 		size = vfs_getxattr(old, name, value, XATTR_SIZE_MAX);
-		if (size <= 0) {
+		if (size < 0) {
 			error = size;
 			goto out_free_value;
 		}