lkml.org 
[lkml]   [2004]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] Zero last byte of mount option page.
Hi Al,

Here's a patch which zeroes the last byte of the mount option data copied
from userspace during mount(2).

For filesystems which parse mount options as strings (the majority), lack
of a zero terminator could cause the page to be overrun. The source code
comments specify that the maximum size of the mount data is PAGE_SIZE-1,
so this patch will not affect any valid binary-formatted mount data.

Patch is against 2.6.2-rc1-mm2, and also applies to recent 2.4.

- James
--
James Morris
<jmorris@redhat.com>

diff -urN -X dontdiff linux-2.6.2-rc1-mm2.o/fs/namespace.c linux-2.6.2-rc1-mm2.w/fs/namespace.c
--- linux-2.6.2-rc1-mm2.o/fs/namespace.c 2004-01-23 14:30:05.000000000 -0500
+++ linux-2.6.2-rc1-mm2.w/fs/namespace.c 2004-01-24 09:46:52.000919520 -0500
@@ -763,6 +763,9 @@
if (dev_name && !memchr(dev_name, 0, PAGE_SIZE))
return -EINVAL;

+ if (data_page)
+ ((char *)data_page)[PAGE_SIZE - 1] = 0;
+
/* Separate the per-mountpoint flags */
if (flags & MS_NOSUID)
mnt_flags |= MNT_NOSUID;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:00    [W:0.031 / U:0.156 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site