From: Sascha Hauer <s.hauer@pengutronix.de>
To: Barebox List <barebox@lists.infradead.org>
Subject: [PATCH 2/5] fs: tftp: fix memory hole
Date: Thu, 30 Aug 2018 12:45:24 +0200 [thread overview]
Message-ID: <20180830104527.4057-3-s.hauer@pengutronix.de> (raw)
In-Reply-To: <20180830104527.4057-1-s.hauer@pengutronix.de>
dpath() returns a pointer to an allocated string, so we have to free it.
Put the pointer into our file private data and free it on close time.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
fs/tftp.c | 17 +++++++----------
1 file changed, 7 insertions(+), 10 deletions(-)
diff --git a/fs/tftp.c b/fs/tftp.c
index 025edbfb86..bcb95bc1db 100644
--- a/fs/tftp.c
+++ b/fs/tftp.c
@@ -79,7 +79,7 @@ struct file_priv {
uint16_t last_block;
int state;
int err;
- const char *filename;
+ char *filename;
int filesize;
uint64_t resend_timeout;
uint64_t progress_timeout;
@@ -139,7 +139,7 @@ static int tftp_send(struct file_priv *priv)
"%d%c"
"blksize%c"
"1432",
- priv->filename, 0,
+ priv->filename + 1, 0,
0,
0,
TIMEOUT, 0,
@@ -374,16 +374,15 @@ static void tftp_handler(void *ctx, char *packet, unsigned len)
}
static struct file_priv *tftp_do_open(struct device_d *dev,
- int accmode, const char *filename)
+ int accmode, struct dentry *dentry)
{
+ struct fs_device_d *fsdev = dev_to_fs_device(dev);
struct file_priv *priv;
struct tftp_priv *tpriv = dev->priv;
int ret;
priv = xzalloc(sizeof(*priv));
- filename++;
-
switch (accmode & O_ACCMODE) {
case O_RDONLY:
priv->push = 0;
@@ -408,7 +407,7 @@ static struct file_priv *tftp_do_open(struct device_d *dev,
priv->block = 1;
priv->err = -EINVAL;
- priv->filename = filename;
+ priv->filename = dpath(dentry, fsdev->vfsmount.mnt_root);
priv->blocksize = TFTP_BLOCK_SIZE;
priv->block_requested = -1;
@@ -461,11 +460,8 @@ out:
static int tftp_open(struct device_d *dev, FILE *file, const char *filename)
{
struct file_priv *priv;
- struct fs_device_d *fsdev = dev_to_fs_device(dev);
-
- filename = dpath(file->dentry, fsdev->vfsmount.mnt_root);
- priv = tftp_do_open(dev, file->flags, filename);
+ priv = tftp_do_open(dev, file->flags, file->dentry);
if (IS_ERR(priv))
return PTR_ERR(priv);
@@ -507,6 +503,7 @@ static int tftp_do_close(struct file_priv *priv)
net_unregister(priv->tftp_con);
kfifo_free(priv->fifo);
+ free(priv->filename);
free(priv->buf);
free(priv);
--
2.18.0
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
next prev parent reply other threads:[~2018-08-30 10:46 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-30 10:45 TFTP improvements Sascha Hauer
2018-08-30 10:45 ` [PATCH 1/5] fs: tftp: overhaul debugging Sascha Hauer
2018-08-30 10:45 ` Sascha Hauer [this message]
2018-08-30 10:45 ` [PATCH 3/5] fs: tftp: fix return value Sascha Hauer
2018-08-30 10:45 ` [PATCH 4/5] fs: tftp: hide files which are actually not present on the server Sascha Hauer
2018-08-30 11:40 ` Steffen Trumtrar
2018-08-30 10:45 ` [PATCH 5/5] fs: tftp: improve file size handling Sascha Hauer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180830104527.4057-3-s.hauer@pengutronix.de \
--to=s.hauer@pengutronix.de \
--cc=barebox@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox