[PATCH] affs_fill_super() %s abuses

[PATCH] affs_fill_super() %s abuses

[Al Viro]

%s is valid only on NUL-terminated arrays, damnit!

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

---

 fs/affs/super.c |   20 ++++++++++++++------
 1 files changed, 14 insertions(+), 6 deletions(-)

02cc7ba4e655dc01773f43e5324986188d42653d
diff --git a/fs/affs/super.c b/fs/affs/super.c
index 4d7e5b1..02aeb22 100644
--- a/fs/affs/super.c
+++ b/fs/affs/super.c
@@ -271,6 +271,7 @@ static int affs_fill_super(struct super_
 	int			 reserved;
 	unsigned long		 mount_flags;
 	int			 tmp_flags;	/* fix remount prototype... */
+	u8			 sig[4];
 
 	pr_debug("AFFS: read_super(%s)\n",data ? (const char *)data : "no options");
 
@@ -370,8 +371,9 @@ got_root:
 		printk(KERN_ERR "AFFS: Cannot read boot block\n");
 		goto out_error;
 	}
-	chksum = be32_to_cpu(*(__be32 *)boot_bh->b_data);
+	memcpy(sig, boot_bh->b_data, 4);
 	brelse(boot_bh);
+	chksum = be32_to_cpu(*(__be32 *)sig);
 
 	/* Dircache filesystems are compatible with non-dircache ones
 	 * when reading. As long as they aren't supported, writing is
@@ -420,11 +422,17 @@ got_root:
 	}
 
 	if (mount_flags & SF_VERBOSE) {
-		chksum = cpu_to_be32(chksum);
-		printk(KERN_NOTICE "AFFS: Mounting volume \"%*s\": Type=%.3s\\%c, Blocksize=%d\n",
-			AFFS_ROOT_TAIL(sb, root_bh)->disk_name[0],
-			AFFS_ROOT_TAIL(sb, root_bh)->disk_name + 1,
-			(char *)&chksum,((char *)&chksum)[3] + '0',blocksize);
+		int len = AFFS_ROOT_TAIL(sb, root_bh)->disk_name[0];
+		char name[32];
+
+		if (len > 31)
+			len = 31;
+		memcpy(name, AFFS_ROOT_TAIL(sb, root_bh)->disk_name + 1, len);
+		name[len] = '\0';
+
+		printk(KERN_NOTICE "AFFS: Mounting volume \"%*s\": "
+			"Type=%c%c%c\\%c, Blocksize=%d\n",
+			len, name, sig[0], sig[1], sig[2], sig[3], blocksize);
 	}
 
 	sb->s_flags |= MS_NODEV | MS_NOSUID;
-- 
1.3.GIT

Re: [PATCH] affs_fill_super() %s abuses

[Andreas Schwab]

Al Viro <viro@ftp.linux.org.uk> writes:

> %s is valid only on NUL-terminated arrays, damnit!

Unless it specifies an approriate precision.

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: [PATCH] affs_fill_super() %s abuses

[Al Viro]

On Thu, Jun 15, 2006 at 01:56:59PM +0200, Andreas Schwab wrote:
> Al Viro <viro@ftp.linux.org.uk> writes:
> 
> > %s is valid only on NUL-terminated arrays, damnit!
> 
> Unless it specifies an approriate precision.

... and that precision does not exceed the size of array.  Here we have
AFFS_ROOT_TAIL(sb, root_bh)->disk_name[0] as precision and
AFFS_ROOT_TAIL(sb, root_bh)->disk_name + 1 as pointer.  Which is closer
to the end of object than 256 bytes.

Re: [PATCH] affs_fill_super() %s abuses

[Roman Zippel]

Hi,

On Thu, 15 Jun 2006, Al Viro wrote:

> @@ -420,11 +422,17 @@ got_root:
>  	}
>  
>  	if (mount_flags & SF_VERBOSE) {
> -		chksum = cpu_to_be32(chksum);
> -		printk(KERN_NOTICE "AFFS: Mounting volume \"%*s\": Type=%.3s\\%c, Blocksize=%d\n",
> -			AFFS_ROOT_TAIL(sb, root_bh)->disk_name[0],
> -			AFFS_ROOT_TAIL(sb, root_bh)->disk_name + 1,
> -			(char *)&chksum,((char *)&chksum)[3] + '0',blocksize);
> +		int len = AFFS_ROOT_TAIL(sb, root_bh)->disk_name[0];
> +		char name[32];
> +
> +		if (len > 31)
> +			len = 31;

You get the same effect by changing it above into "min(AFFS_ROOT_TAIL(sb, 
root_bh)->disk_name[0], 31)" and makes the copying unnecessary.
BTW since this is only active with SF_VERBOSE, I don't think it's critical 
enough for 2.6.17 at this point.

bye, Roman

Re: [PATCH] affs_fill_super() %s abuses

[Al Viro]

On Thu, Jun 15, 2006 at 02:31:05PM +0200, Roman Zippel wrote:
> > -		printk(KERN_NOTICE "AFFS: Mounting volume \"%*s\": Type=%.3s\\%c, Blocksize=%d\n",
> > -			AFFS_ROOT_TAIL(sb, root_bh)->disk_name[0],
> > -			AFFS_ROOT_TAIL(sb, root_bh)->disk_name + 1,
> > -			(char *)&chksum,((char *)&chksum)[3] + '0',blocksize);
> > +		int len = AFFS_ROOT_TAIL(sb, root_bh)->disk_name[0];
> > +		char name[32];
> > +
> > +		if (len > 31)
> > +			len = 31;
> 
> You get the same effect by changing it above into "min(AFFS_ROOT_TAIL(sb, 
> root_bh)->disk_name[0], 31)" and makes the copying unnecessary.
> BTW since this is only active with SF_VERBOSE, I don't think it's critical 
> enough for 2.6.17 at this point.

Fine by me...  I'd still prefer more explicit form (it's hardly a critical
path), but yes, that would do.

Re: [PATCH] affs_fill_super() %s abuses

[Andreas Schwab]

Roman Zippel <zippel@linux-m68k.org> writes:

> Hi,
>
> On Thu, 15 Jun 2006, Al Viro wrote:
>
>> @@ -420,11 +422,17 @@ got_root:
>>  	}
>>  
>>  	if (mount_flags & SF_VERBOSE) {
>> -		chksum = cpu_to_be32(chksum);
>> -		printk(KERN_NOTICE "AFFS: Mounting volume \"%*s\": Type=%.3s\\%c, Blocksize=%d\n",
>> -			AFFS_ROOT_TAIL(sb, root_bh)->disk_name[0],
>> -			AFFS_ROOT_TAIL(sb, root_bh)->disk_name + 1,
>> -			(char *)&chksum,((char *)&chksum)[3] + '0',blocksize);
>> +		int len = AFFS_ROOT_TAIL(sb, root_bh)->disk_name[0];
>> +		char name[32];
>> +
>> +		if (len > 31)
>> +			len = 31;
>
> You get the same effect by changing it above into "min(AFFS_ROOT_TAIL(sb, 
> root_bh)->disk_name[0], 31)" and makes the copying unnecessary.

And "%*s" needs to be changed to "%.*s" (the former still requires a
NUL-terminated string).

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."