linux-kernel - Re: [PATCH] zram: fix bug storing backing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 13 Aug 2018 15:16:23 +0900
From:   Minchan Kim <minchan@...nel.org>
To:     Peter Kalauskas <peskal@...gle.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] zram: fix bug storing backing_dev

On Wed, Aug 08, 2018 at 03:31:00PM -0700, Peter Kalauskas wrote:
> The call to strlcpy in backing_dev_store is incorrect. It should take
> the size of the destination buffer instead of the size of the source
> buffer.  Additionally, ignore the newline character (\n) when reading
> the new file_name buffer. This makes it possible to set the backing_dev
> as follows:
> 
>   echo /dev/sdX > /sys/block/zram0/backing_dev
> 
> Signed-off-by: Peter Kalauskas <peskal@...gle.com>
Acked-by: Minchan Kim <minchan@...nel.org>

Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
CC: LKML <linux-kernel@...r.kernel.org>
Cc: <stable@...r.kernel.org>    [4.14+]

> ---
>  drivers/block/zram/zram_drv.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
> index 7436b2d27fa3..3137faea1493 100644
> --- a/drivers/block/zram/zram_drv.c
> +++ b/drivers/block/zram/zram_drv.c
> @@ -336,6 +336,7 @@ static ssize_t backing_dev_store(struct device *dev,
>  		struct device_attribute *attr, const char *buf, size_t len)
>  {
>  	char *file_name;
> +	size_t sz;
>  	struct file *backing_dev = NULL;
>  	struct inode *inode;
>  	struct address_space *mapping;
> @@ -356,7 +357,11 @@ static ssize_t backing_dev_store(struct device *dev,
>  		goto out;
>  	}
>  
> -	strlcpy(file_name, buf, len);
> +	strlcpy(file_name, buf, PATH_MAX);
> +	/* ignore trailing newline */
> +	sz = strlen(file_name);
> +	if (sz > 0 && file_name[sz - 1] == '\n')
> +		file_name[sz - 1] = 0x00;
>  
>  	backing_dev = filp_open(file_name, O_RDWR|O_LARGEFILE, 0);
>  	if (IS_ERR(backing_dev)) {
> -- 
> 2.18.0.597.ga71716f1ad-goog
>