* [PATCH] btrfs: Null terminate string in scan device ioctl
@ 2011-06-03 17:34 Milan Broz
0 siblings, 0 replies; only message in thread
From: Milan Broz @ 2011-06-03 17:34 UTC (permalink / raw)
To: linux-btrfs; +Cc: Milan Broz
btrfs_scan_one_device() directly uses vol->name
without additional checks so in the case of unterminated
string in ioctl it can access memory outside
of btrfs_ioctl_vol_args struct.
Always terminate name string (as the same as other users
do already).
Signed-off-by: Milan Broz <mbroz@redhat.com>
---
fs/btrfs/super.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 9b2e7e5..2bb1a99 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1148,6 +1148,8 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
if (IS_ERR(vol))
return PTR_ERR(vol);
+ vol->name[BTRFS_PATH_NAME_MAX] = '\0';
+
switch (cmd) {
case BTRFS_IOC_SCAN_DEV:
ret = btrfs_scan_one_device(vol->name, FMODE_READ,
--
1.7.5.3
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2011-06-03 17:34 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-06-03 17:34 [PATCH] btrfs: Null terminate string in scan device ioctl Milan Broz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).