lkml.org 
[lkml]   [2011]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [PATCH v2] ext4: Prevent stack overrun in ext4_file_open when recording last known mountpoint
    On Fri, Sep 16, 2011 at 11:40:05AM -0700, Darrick J. Wong wrote:
    > In ext4_file_open, the filesystem records the mountpoint of the first file that
    > is opened after mounting the filesystem. It does this by allocating a 64-byte
    > stack buffer, calling d_path() to grab the mount point through which this file
    > was accessed, and then memcpy()ing 64 bytes into the superblock's
    > s_last_mounted field, starting from the return value of d_path(), which is
    > stored as "cp". However, if cp > buf (which it frequently is since path
    > components are prepended starting at the end of buf) then we can end up copying
    > stack data into the superblock.
    >
    > Writing stack variables into the superblock doesn't sound like a great idea, so
    > use strlcpy instead. Andi Kleen suggested using strlcpy instead of strncpy.

    Ok, it's been a couple of weeks.... any thoughts, Ted?

    --D
    >
    > Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
    > ---
    >
    > fs/ext4/file.c | 4 ++--
    > 1 files changed, 2 insertions(+), 2 deletions(-)
    >
    > diff --git a/fs/ext4/file.c b/fs/ext4/file.c
    > index e4095e9..9781099 100644
    > --- a/fs/ext4/file.c
    > +++ b/fs/ext4/file.c
    > @@ -181,8 +181,8 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
    > path.dentry = mnt->mnt_root;
    > cp = d_path(&path, buf, sizeof(buf));
    > if (!IS_ERR(cp)) {
    > - memcpy(sbi->s_es->s_last_mounted, cp,
    > - sizeof(sbi->s_es->s_last_mounted));
    > + strlcpy(sbi->s_es->s_last_mounted, cp,
    > + sizeof(sbi->s_es->s_last_mounted));
    > ext4_mark_super_dirty(sb);
    > }
    > }
    > --
    > To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
    > the body of a message to majordomo@vger.kernel.org
    > More majordomo info at http://vger.kernel.org/majordomo-info.html
    >


    \
     
     \ /
      Last update: 2011-09-30 21:49    [W:0.025 / U:64.612 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site