From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark Salyzyn via Linux-f2fs-devel Subject: Re: [PATCH v15 1/4] Add flags option to get xattr method paired to __vfs_getxattr Date: Tue, 5 Nov 2019 07:37:04 -0800 Message-ID: <1de43656-e751-53a2-c0da-ff44ecbabbc4@android.com> References: <20191104215253.141818-1-salyzyn@android.com> <20191104215253.141818-2-salyzyn@android.com> <20191105094830.GL22379@quack2.suse.cz> Reply-To: Mark Salyzyn Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20191105094830.GL22379@quack2.suse.cz> Content-Language: en-GB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: linux-f2fs-devel-bounces@lists.sourceforge.net To: Jan Kara Cc: Latchesar Ionkov , Dave Kleikamp , jfs-discussion@lists.sourceforge.net, linux-doc@vger.kernel.org, linux-integrity@vger.kernel.org, Greg Kroah-Hartman , Martin Brandenburg , samba-technical@lists.samba.org, Dominique Martinet , Artem Bityutskiy , Adrian Hunter , David Howells , Chris Mason , "David S. Miller" , Andreas Dilger , Eric Paris , Mauro Carvalho Chehab , netdev@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net, linux-afs@lists.infradead.org, Mike Marshall , linux-xfs@vger.kernel.org, linux-unionfs@vger.kernel.org, Andreas Gruenbacher List-Id: ceph-devel.vger.kernel.org On 11/5/19 1:48 AM, Jan Kara wrote: >> @@ -228,11 +228,11 @@ static int afs_xattr_get_yfs(const struct xattr_handler *handler, >> break; >> case 1: >> data = buf; >> - dsize = snprintf(buf, sizeof(buf), "%u", yacl->inherit_flag); >> + dsize = scnprintf(buf, sizeof(buf), "%u", yacl->inherit_flag); >> break; >> case 2: >> data = buf; >> - dsize = snprintf(buf, sizeof(buf), "%u", yacl->num_cleaned); >> + dsize = scnprintf(buf, sizeof(buf), "%u", yacl->num_cleaned); >> break; >> case 3: > These scnprintf() changes (and there are more in the patch) probably > shouldn't be here... Otherwise the patch still looks good to me :). > > Honza > Good catch, they were done in locality, I forgot about them, this patch series has been living for almost a year now and time has become its enemy ... will spin this as a separate patch. They strike as a security issue with the possibility of fragile UAF when the code is maintained by future selves. -- Mark