* [PATCH] dm: ioctl: reserve space for NUL-terminator in build_constructor_string()
@ 2026-07-19 13:01 Ilya Krutskih
0 siblings, 0 replies; only message in thread
From: Ilya Krutskih @ 2026-07-19 13:01 UTC (permalink / raw)
To: Alasdair Kergon
Cc: Ilya Krutskih, lvc-patches, Mike Snitzer, Mikulas Patocka,
Benjamin Marzinski, dm-devel, linux-kernel, stable
Reserve space for the termination NUL after the maximum 20 decimal
digits of a long long value to avoid buffer overflow in sprintf().
Fixes: f5db4af466e2 ("dm raid1: add userspace log")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Krutskih <devsec@tpz.ru>
---
drivers/md/dm-log-userspace-base.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/md/dm-log-userspace-base.c b/drivers/md/dm-log-userspace-base.c
index 9fbb4b48fb2b..fda97368a72b 100644
--- a/drivers/md/dm-log-userspace-base.c
+++ b/drivers/md/dm-log-userspace-base.c
@@ -139,6 +139,7 @@ static int build_constructor_string(struct dm_target *ti,
str_size += strlen(argv[i]) + 1; /* +1 for space between args */
str_size += 20; /* Max number of chars in a printed u64 number */
+ str_size++; /* For NUL-terminator */
str = kzalloc(str_size, GFP_KERNEL);
if (!str) {
--
2.43.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-19 13:11 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-19 13:01 [PATCH] dm: ioctl: reserve space for NUL-terminator in build_constructor_string() Ilya Krutskih
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.