[PATCH v2 1/1] block: partition: aix: bound LV name formatting

[PATCH v2 1/1] block: partition: aix: bound LV name formatting

[Ren Wei]

From: Zhiling Zou <roxy520tt@gmail.com>

AIX logical volume names are stored on disk as fixed-size fields.
The partition parser reads them into struct lvname, but later formats
the fields with %s. If an on-disk name is not NUL-terminated, the string
formatting code can keep reading past the end of the 64-byte name field.

Limit the formatted string length to the size of the on-disk name field
when printing AIX logical volume names.

Fixes: 6ceea22bbbc8 ("partitions: add aix lvm partition support files")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
---
changes in v2:
- Print non-contiguous LV names directly with a bounded %.*s format
  in pr_warn() instead of copying them through a temporary buffer.
- v1 Link: https://lore.kernel.org/all/6f381f63ccfe458e15067fd9b9428884cb8d5f97.1782407859.git.roxy520tt@gmail.com/

 block/partitions/aix.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/block/partitions/aix.c b/block/partitions/aix.c
index f3c4174e003e..fe2d2cb0c4e7 100644
--- a/block/partitions/aix.c
+++ b/block/partitions/aix.c
@@ -261,7 +261,8 @@ int aix_partition(struct parsed_partitions *state)
 				put_partition(state, lv_ix + 1,
 				  (i + 1 - lp_ix) * pp_blocks_size + psn_part1,
 				  lvip[lv_ix].pps_per_lv * pp_blocks_size);
-				seq_buf_printf(&state->pp_buf, " <%s>\n",
+				seq_buf_printf(&state->pp_buf, " <%.*s>\n",
+					       (int)sizeof(n[lv_ix].name),
 					       n[lv_ix].name);
 				lvip[lv_ix].lv_is_contiguous = 1;
 				ret = 1;
@@ -271,12 +272,10 @@ int aix_partition(struct parsed_partitions *state)
 		}
 		for (i = 0; i < state->limit; i += 1)
 			if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) {
-				char tmp[sizeof(n[i].name) + 1]; // null char
-
-				snprintf(tmp, sizeof(tmp), "%s", n[i].name);
-				pr_warn("partition %s (%u pp's found) is "
+				pr_warn("partition %.*s (%u pp's found) is "
 					"not contiguous\n",
-					tmp, lvip[i].pps_found);
+					(int)sizeof(n[i].name), n[i].name,
+					lvip[i].pps_found);
 			}
 		kfree(pvd);
 	}
-- 
2.43.0

Re: [PATCH v2 1/1] block: partition: aix: bound LV name formatting

[Philippe De Muyter]

Hello Ren Wei,

On Sat, Jul 11, 2026 at 03:22:52PM +0800, Ren Wei wrote:
> From: Zhiling Zou <roxy520tt@gmail.com>
> 
> AIX logical volume names are stored on disk as fixed-size fields.
> The partition parser reads them into struct lvname, but later formats
> the fields with %s. If an on-disk name is not NUL-terminated, the string
> formatting code can keep reading past the end of the 64-byte name field.
> 
> Limit the formatted string length to the size of the on-disk name field
> when printing AIX logical volume names.
> 
> Fixes: 6ceea22bbbc8 ("partitions: add aix lvm partition support files")
> Cc: stable@kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
> ---
> changes in v2:
> - Print non-contiguous LV names directly with a bounded %.*s format
>   in pr_warn() instead of copying them through a temporary buffer.
> - v1 Link: https://lore.kernel.org/all/6f381f63ccfe458e15067fd9b9428884cb8d5f97.1782407859.git.roxy520tt@gmail.com/
> 
>  block/partitions/aix.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/block/partitions/aix.c b/block/partitions/aix.c
> index f3c4174e003e..fe2d2cb0c4e7 100644
> --- a/block/partitions/aix.c
> +++ b/block/partitions/aix.c
> @@ -261,7 +261,8 @@ int aix_partition(struct parsed_partitions *state)
>  				put_partition(state, lv_ix + 1,
>  				  (i + 1 - lp_ix) * pp_blocks_size + psn_part1,
>  				  lvip[lv_ix].pps_per_lv * pp_blocks_size);
> -				seq_buf_printf(&state->pp_buf, " <%s>\n",
> +				seq_buf_printf(&state->pp_buf, " <%.*s>\n",
> +					       (int)sizeof(n[lv_ix].name),
>  					       n[lv_ix].name);
>  				lvip[lv_ix].lv_is_contiguous = 1;
>  				ret = 1;
> @@ -271,12 +272,10 @@ int aix_partition(struct parsed_partitions *state)
>  		}
>  		for (i = 0; i < state->limit; i += 1)
>  			if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) {
> -				char tmp[sizeof(n[i].name) + 1]; // null char
> -
> -				snprintf(tmp, sizeof(tmp), "%s", n[i].name);
> -				pr_warn("partition %s (%u pp's found) is "
> +				pr_warn("partition %.*s (%u pp's found) is "
>  					"not contiguous\n",
> -					tmp, lvip[i].pps_found);
> +					(int)sizeof(n[i].name), n[i].name,
> +					lvip[i].pps_found);
>  			}
>  		kfree(pvd);
>  	}
> -- 
> 2.43.0

Reviewed-by: Philippe De Muyter <phdm@macqel.be>

Thanks

Philippe