lkml.org 
[lkml]   [2018]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Date
SubjectRe: KASAN: slab-out-of-bounds Read in string (2)
On Thu, Oct 25, 2018 at 6:02 PM Bruce Fields <bfields@fieldses.org> wrote:

> > > So I guess it has fallen between the cracks.
> > > Feel free to send a patch to Jeff.
> > >
> > > Thanks,
> > > Amir.
> >
> > Actually, this should probably go to Bruce, as he mostly takes care of
> > lockd. Patch looks correct though.
>
> Yes, if you could resend I'd be happy to handle it.--b.

Attached.
Thanks,
Amir.
From 40000f4dcbd5dd18a80efb6aef010f1164985583 Mon Sep 17 00:00:00 2001
From: Amir Goldstein <amir73il@gmail.com>
Date: Fri, 28 Sep 2018 20:41:48 +0300
Subject: [PATCH] lockd: fix access beyond unterminated strings in prints

printk format used %*s instead of %.*s, so hostname_len does not limit
the number of bytes accessed from hostname.

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
fs/lockd/host.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index d35cd6be0675..93fb7cf0b92b 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -341,7 +341,7 @@ struct nlm_host *nlmsvc_lookup_host(const struct svc_rqst *rqstp,
};
struct lockd_net *ln = net_generic(net, lockd_net_id);

- dprintk("lockd: %s(host='%*s', vers=%u, proto=%s)\n", __func__,
+ dprintk("lockd: %s(host='%.*s', vers=%u, proto=%s)\n", __func__,
(int)hostname_len, hostname, rqstp->rq_vers,
(rqstp->rq_prot == IPPROTO_UDP ? "udp" : "tcp"));

--
2.17.1
\
 
 \ /
  Last update: 2018-10-25 17:18    [W:0.057 / U:0.712 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site