linux-kernel - Re: [PATCH 2/2] add some safety checks for label store interface of flash dev in sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CA+NNRhER-MdM=ufG0-gOPRvGysR5FuDvFRJtRNf7TX6yQDpH7w@mail.gmail.com>
Date:   Sat, 15 Sep 2018 09:20:11 +0800
From:   Junhui Tang <tang.junhui.linux@...il.com>
To:     cdbdyx@....com
Cc:     colyli@...e.de, Kent Overstreet <kent.overstreet@...il.com>,
        linux-bcache@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] add some safety checks for label store interface of
 flash dev in sysfs

Seems something wrong
when  size = SB_LABEL_SIZE and   u->label[size - 1] != '\n'
please check again.

---------------------------------------------------------------------------
Tang Junhui
Forever me is me
---------------------------------------------------------------------------

Dongbo Cao <cdbdyx@....com> 于2018年9月14日周五 下午6:13写道：
>
> do some checks on the label's length and ending.
>
> Signed-off-by: Dongbo Cao <cdbdyx@....com>
> ---
>  drivers/md/bcache/sysfs.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
> index e64c718f..cce793ef 100644
> --- a/drivers/md/bcache/sysfs.c
> +++ b/drivers/md/bcache/sysfs.c
> @@ -447,8 +447,15 @@ STORE(__bch_flash_dev)
>         }
>
>         if (attr == &sysfs_label) {
> +               if (size > SB_LABEL_SIZE)
> +                       return -EINVAL;
>                 memcpy(u->label, buf, SB_LABEL_SIZE);
> -               bch_uuid_write(d->c);
> +               if (size < SB_LABEL_SIZE)
> +                       u->label[size] = '\0';
> +               if (size && u->label[size - 1] == '\n')
> +                       u->label[size - 1] = '\0';
> +               if(d->c)
> +                       bch_uuid_write(d->c);
>         }
>
>         if (attr == &sysfs_unregister) {
> --
> 2.17.1
>
>