This message generated a parse failure. Raw output follows here. Please use 'back' to navigate. From devnull@lkml.org Fri Apr 19 07:46:01 2024 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id ; Thu, 27 Feb 2003 09:14:03 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id ; Thu, 27 Feb 2003 09:14:03 -0500 Received: from e31.co.us.ibm.com ([32.97.110.129]:17351 "EHLO e31.co.us.ibm.com") by vger.kernel.org with ESMTP id ; Thu, 27 Feb 2003 09:14:01 -0500 Received: from westrelay02.boulder.ibm.com (westrelay02.boulder.ibm.com [9.17.195.11]) by e31.co.us.ibm.com (8.12.7/8.12.2) with ESMTP id h1REOEld046200; Thu, 27 Feb 2003 09:24:14 -0500 Received: from austin.ibm.com (d03av02.boulder.ibm.com [9.17.193.82]) by westrelay02.boulder.ibm.com (8.12.3/NCO/VER6.5) with ESMTP id h1REOCUN536974; Thu, 27 Feb 2003 07:24:12 -0700 Received: from popmail.austin.ibm.com (popmail.austin.ibm.com [9.41.248.164]) by austin.ibm.com (8.12.6/8.12.6) with ESMTP id h1REOBVO036582; Thu, 27 Feb 2003 08:24:11 -0600 Received: from boiler (boiler.austin.ibm.com [9.41.94.128]) by popmail.austin.ibm.com (AIX4.3/8.9.3/8.7-client1.01) with SMTP id IAA44026; Thu, 27 Feb 2003 08:24:10 -0600 Content-Type: text/plain; charset=US-ASCII From: Kevin Corry Organization: IBM To: Horst von Brand , Joe Thornber Subject: Re: [PATCH 3/8] dm: prevent possible buffer overflow in ioctl interface Date: Thu, 27 Feb 2003 08:20:59 -0600 X-Mailer: KMail [version 1.2] Cc: Linus Torvalds , Linux Mailing List , vonbrand@eeyore.valparaiso.cl References: <200302262104.h1QL4aiC001941@eeyore.valparaiso.cl> In-Reply-To: <200302262104.h1QL4aiC001941@eeyore.valparaiso.cl> Mime-Version: 1.0 Message-Id: <03022708205903.05199@boiler> Content-Transfer-Encoding: 7BIT Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org On Wednesday 26 February 2003 15:04, Horst von Brand wrote: > Joe Thornber said: > > Use the correct size for "name" in register_with_devfs(). > > > > During Al Viro's devfs cleanup a few versions ago, this function was > > rewritten, and the "name" string added. The 32-byte size is not large > > enough to prevent a possible buffer overflow in the sprintf() call, > > since the hash cell can have a name up to 128 characters. > > > > [Kevin Corry] > > > > --- diff/drivers/md/dm-ioctl.c 2003-02-26 16:09:42.000000000 +0000 > > +++ source/drivers/md/dm-ioctl.c 2003-02-26 16:09:52.000000000 +0000 > > @@ -173,7 +173,7 @@ > > */ > > static int register_with_devfs(struct hash_cell *hc) > > { > > - char name[32]; > > + char name[DM_NAME_LEN + strlen(DM_DIR) + 1]; > > This either makes a large name array or generates a possibly huge array at > runtime (bad if your stack is < 8KiB). Would this be better? -- Kevin Corry corryk@us.ibm.com http://evms.sourceforge.net/ --- linux-2.5.60a/drivers/md/dm-ioctl.c 2003/02/13 16:43:26 +++ linux-2.5.60b/drivers/md/dm-ioctl.c 2003/02/27 14:17:00 @@ -173,8 +173,11 @@ */ static int register_with_devfs(struct hash_cell *hc) { - char name[DM_NAME_LEN + strlen(DM_DIR) + 1]; struct gendisk *disk = dm_disk(hc->md); + char *name = kmalloc(DM_NAME_LEN + strlen(DM_DIR) + 1); + if (!name) { + return -ENOMEM; + } sprintf(name, DM_DIR "/%s", hc->name); devfs_register(NULL, name, DEVFS_FL_CURRENT_OWNER,  - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/