* [PATCH] blk: fix string handling in elv_iosched_store
@ 2005-11-09 17:11 Tejun Heo
2005-11-09 18:02 ` Tejun Heo
0 siblings, 1 reply; 3+ messages in thread
From: Tejun Heo @ 2005-11-09 17:11 UTC (permalink / raw)
To: axboe, linux-kernel
elv_iosched_store doesn't terminate string passed from userspace if
it's too long. Also, if the written length is zero (probably not
possible), it accesses elevator_name[-1]. This patch fixes both bugs.
Signed-off-by: Tejun Heo <htejun@gmail.com>
diff --git a/block/elevator.c b/block/elevator.c
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -744,13 +744,15 @@ error:
ssize_t elv_iosched_store(request_queue_t *q, const char *name, size_t count)
{
char elevator_name[ELV_NAME_MAX];
+ size_t len;
struct elevator_type *e;
memset(elevator_name, 0, sizeof(elevator_name));
- strncpy(elevator_name, name, sizeof(elevator_name));
+ strncpy(elevator_name, name, sizeof(elevator_name) - 1);
+ len = strlen(elevator_name);
- if (elevator_name[strlen(elevator_name) - 1] == '\n')
- elevator_name[strlen(elevator_name) - 1] = '\0';
+ if (len && elevator_name[len - 1] == '\n')
+ elevator_name[len - 1] = '\0';
e = elevator_get(elevator_name);
if (!e) {
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] blk: fix string handling in elv_iosched_store
2005-11-09 17:11 [PATCH] blk: fix string handling in elv_iosched_store Tejun Heo
@ 2005-11-09 18:02 ` Tejun Heo
2005-11-10 7:55 ` Jens Axboe
0 siblings, 1 reply; 3+ messages in thread
From: Tejun Heo @ 2005-11-09 18:02 UTC (permalink / raw)
To: axboe, linux-kernel; +Cc: bernd
elv_iosched_store doesn't terminate string passed from userspace if
it's too long. Also, if the written length is zero (probably not
possible), it accesses elevator_name[-1]. This patch fixes both bugs.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Cc: Bernd Petrovitsch <bernd@firmix.at>
---
In a private mail, Bernd Petrovitsch pointed out that memset can be
replaced with elevator_name[sizeof(elevator_name) - 1] = '\0'.
Thanks.
diff --git a/block/elevator.c b/block/elevator.c
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -744,13 +744,15 @@ error:
ssize_t elv_iosched_store(request_queue_t *q, const char *name, size_t count)
{
char elevator_name[ELV_NAME_MAX];
+ size_t len;
struct elevator_type *e;
- memset(elevator_name, 0, sizeof(elevator_name));
- strncpy(elevator_name, name, sizeof(elevator_name));
+ elevator_name[sizeof(elevator_name) - 1] = '\0';
+ strncpy(elevator_name, name, sizeof(elevator_name) - 1);
+ len = strlen(elevator_name);
- if (elevator_name[strlen(elevator_name) - 1] == '\n')
- elevator_name[strlen(elevator_name) - 1] = '\0';
+ if (len && elevator_name[len - 1] == '\n')
+ elevator_name[len - 1] = '\0';
e = elevator_get(elevator_name);
if (!e) {
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] blk: fix string handling in elv_iosched_store
2005-11-09 18:02 ` Tejun Heo
@ 2005-11-10 7:55 ` Jens Axboe
0 siblings, 0 replies; 3+ messages in thread
From: Jens Axboe @ 2005-11-10 7:55 UTC (permalink / raw)
To: Tejun Heo; +Cc: linux-kernel, bernd
On Thu, Nov 10 2005, Tejun Heo wrote:
> elv_iosched_store doesn't terminate string passed from userspace if
> it's too long. Also, if the written length is zero (probably not
> possible), it accesses elevator_name[-1]. This patch fixes both bugs.
>
> Signed-off-by: Tejun Heo <htejun@gmail.com>
> Cc: Bernd Petrovitsch <bernd@firmix.at>
Thanks applied.
--
Jens Axboe
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2005-11-10 7:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-11-09 17:11 [PATCH] blk: fix string handling in elv_iosched_store Tejun Heo
2005-11-09 18:02 ` Tejun Heo
2005-11-10 7:55 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox