* [patch] btrfs: array overflow in btrfs_ioctl_rm_dev_v2()
@ 2016-02-18 5:01 Dan Carpenter
2016-02-18 7:14 ` Anand Jain
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2016-02-18 5:01 UTC (permalink / raw)
To: Chris Mason, Anand Jain
Cc: Josef Bacik, David Sterba, linux-btrfs, kernel-janitors
We were putting the NUL terminator at BTRFS_PATH_NAME_MAX (4087) bytes
instead of BTRFS_SUBVOL_NAME_MAX (4039) so it corrupted memory.
Fixes: 22af1a869288 ('btrfs: introduce device delete by devid')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 5224fc8..77c61b4 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2700,7 +2700,7 @@ static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg)
if (vol_args->flags & BTRFS_DEVICE_SPEC_BY_ID) {
ret = btrfs_rm_device(root, NULL, vol_args->devid);
} else {
- vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
+ vol_args->name[BTRFS_SUBVOL_NAME_MAX] = '\0';
ret = btrfs_rm_device(root, vol_args->name, 0);
}
mutex_unlock(&root->fs_info->volume_mutex);
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [patch] btrfs: array overflow in btrfs_ioctl_rm_dev_v2()
2016-02-18 5:01 [patch] btrfs: array overflow in btrfs_ioctl_rm_dev_v2() Dan Carpenter
@ 2016-02-18 7:14 ` Anand Jain
2016-02-18 8:58 ` David Sterba
0 siblings, 1 reply; 3+ messages in thread
From: Anand Jain @ 2016-02-18 7:14 UTC (permalink / raw)
To: Dan Carpenter, Chris Mason
Cc: Josef Bacik, David Sterba, linux-btrfs, kernel-janitors
Thanks Dan.
Chris pointed out as well. We are working on it..
Just one concern when device is added the max device length is
BTRFS_PATH_NAME_MAX. However below fix is proper from the vol_args
perspective.
Thanks, Anand
On 02/18/2016 01:01 PM, Dan Carpenter wrote:
> We were putting the NUL terminator at BTRFS_PATH_NAME_MAX (4087) bytes
> instead of BTRFS_SUBVOL_NAME_MAX (4039) so it corrupted memory.
>
> Fixes: 22af1a869288 ('btrfs: introduce device delete by devid')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 5224fc8..77c61b4 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -2700,7 +2700,7 @@ static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg)
> if (vol_args->flags & BTRFS_DEVICE_SPEC_BY_ID) {
> ret = btrfs_rm_device(root, NULL, vol_args->devid);
> } else {
> - vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
> + vol_args->name[BTRFS_SUBVOL_NAME_MAX] = '\0';
> ret = btrfs_rm_device(root, vol_args->name, 0);
> }
> mutex_unlock(&root->fs_info->volume_mutex);
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [patch] btrfs: array overflow in btrfs_ioctl_rm_dev_v2()
2016-02-18 7:14 ` Anand Jain
@ 2016-02-18 8:58 ` David Sterba
0 siblings, 0 replies; 3+ messages in thread
From: David Sterba @ 2016-02-18 8:58 UTC (permalink / raw)
To: Anand Jain
Cc: Chris Mason, Dan Carpenter, Josef Bacik, kernel-janitors,
linux-btrfs
On Thu, Feb 18, 2016 at 03:14:04PM +0800, Anand Jain wrote:
>
>
> Thanks Dan.
> Chris pointed out as well. We are working on it..
In for next since yesterday.
> Just one concern when device is added the max device length is
> BTRFS_PATH_NAME_MAX. However below fix is proper from the vol_args
> perspective.
Yeah, there's mess in the various PATH constants, but they're all > 4000
and that should be enough for most uses.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-02-18 8:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-02-18 5:01 [patch] btrfs: array overflow in btrfs_ioctl_rm_dev_v2() Dan Carpenter
2016-02-18 7:14 ` Anand Jain
2016-02-18 8:58 ` David Sterba
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).