All of lore.kernel.org
 help / color / mirror / Atom feed
From: Christoph Hellwig <hch@infradead.org>
To: Huiwen He <hehuiwen@kylinos.cn>
Cc: Jens Axboe <axboe@kernel.dk>,
	Steven Rostedt <rostedt@goodmis.org>,
	Masami Hiramatsu <mhiramat@kernel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
	linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-trace-kernel@vger.kernel.org
Subject: Re: [PATCH] blk-trace: Fix potential buffer overflow in blk_trace_setup()
Date: Tue, 25 Nov 2025 03:12:31 -0800	[thread overview]
Message-ID: <aSWPH51A8NvoD9cm@infradead.org> (raw)
In-Reply-To: <20251125082420.856030-1-hehuiwen@kylinos.cn>

On Tue, Nov 25, 2025 at 04:24:20PM +0800, Huiwen He wrote:
> The legacy struct blk_user_trace_setup has a 32-byte name field,
> while buts2->name is a 64-byte buffer (BLKTRACE_BDEV_SIZE2).
> 
> Since commit 113cbd62824a ("blktrace: pass blk_user_trace2 to setup
> functions"), blk_trace_setup() copied buts2->name into buts->name
> using strcpy(). strcpy() performs no bounds checking on the destination
> buffer, which can overflow if the source string exceeds 31 characters.
> 
> Replace deprecated [1] strcpy() with strscpy() to ensure proper bounds
> checking and prevent potential buffer overflow.

At this point all this has been checked as part of the setup.  If you
hatr strcpy with passing, just doing a memcpy of BLKTRACE_BDEV_SIZE2
is the saner alternative.


      reply	other threads:[~2025-11-25 11:12 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-11-25  8:24 [PATCH] blk-trace: Fix potential buffer overflow in blk_trace_setup() Huiwen He
2025-11-25 11:12 ` Christoph Hellwig [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aSWPH51A8NvoD9cm@infradead.org \
    --to=hch@infradead.org \
    --cc=axboe@kernel.dk \
    --cc=hehuiwen@kylinos.cn \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-trace-kernel@vger.kernel.org \
    --cc=mathieu.desnoyers@efficios.com \
    --cc=mhiramat@kernel.org \
    --cc=rostedt@goodmis.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.