lkml.org 
[lkml]   [2020]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] ext4: Don't leak old mountpoint samples
Thanks for the patch Richard, it looks good to me.

Reviewed-by: Harshad Shirwadkar <harshadshirwadkar@gmail.com>


On Tue, Dec 1, 2020 at 7:29 AM Richard Weinberger <richard@nod.at> wrote:
>
> As soon the first file is opened, ext4 samples the mountpoint
> of the filesystem in 64 bytes of the super block.
> It does so using strlcpy(), this means that the remaining bytes
> in the super block string buffer are untouched.
> If the mount point before had a longer path than the current one,
> it can be reconstructed.
>
> Consider the case where the fs was mounted to "/media/johnjdeveloper"
> and later to "/".
> The the super block buffer then contains "/\x00edia/johnjdeveloper".
>
> This case was seen in the wild and caused confusion how the name
> of a developer ands up on the super block of a filesystem used
> in production...
>
> Fix this by clearing the string buffer before writing to it,
>
> Signed-off-by: Richard Weinberger <richard@nod.at>
> ---
> fs/ext4/file.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/fs/ext4/file.c b/fs/ext4/file.c
> index 3ed8c048fb12..dba521250d01 100644
> --- a/fs/ext4/file.c
> +++ b/fs/ext4/file.c
> @@ -809,6 +809,7 @@ static int ext4_sample_last_mounted(struct super_block *sb,
> err = ext4_journal_get_write_access(handle, sbi->s_sbh);
> if (err)
> goto out_journal;
> + memset(sbi->s_es->s_last_mounted, 0x00, sizeof(sbi->s_es->s_last_mounted));
> strlcpy(sbi->s_es->s_last_mounted, cp,
> sizeof(sbi->s_es->s_last_mounted));
> ext4_handle_dirty_super(handle, sb);
> --
> 2.26.2
>

\
 
 \ /
  Last update: 2020-12-10 00:27    [W:0.054 / U:0.884 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site