Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5516e595 authored by Mark Fasheh's avatar Mark Fasheh Committed by Chris Mason
Browse files

Btrfs: Null terminate strings passed in from userspace 



The 'char name[BTRFS_PATH_NAME_MAX]' member of struct btrfs_ioctl_vol_args
is passed directly to strlen() after being copied from user. I haven't
verified this, but in theory a userspace program could pass in an
unterminated string and cause a kernel crash as strlen walks off the end of
the array.

This patch terminates the ->name string in all btrfs ioctl functions which
currently use a 'struct btrfs_ioctl_vol_args'. Since the string is now
properly terminated, it's length will never be longer than
BTRFS_PATH_NAME_MAX so that error check has been removed.

By the way, it might be better overall to just have the ioctl pass an
unterminated string + length structure but I didn't bother with that since
it'd change the kernel/user interface.

Signed-off-by: default avatarMark Fasheh <mfasheh@suse.com>
Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
parent 9652480b

fs/btrfs/ioctl.c

+5 −8
Original line number Diff line number Diff line
@@ -310,11 +310,9 @@ static int btrfs_ioctl_resize(struct btrfs_root *root, void __user *arg) 
		ret = -EFAULT;

		goto out;

	}



	vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';

	namelen = strlen(vol_args->name);

	if (namelen > BTRFS_VOL_NAME_MAX) {

		ret = -EINVAL;

		goto out;

	}



	mutex_lock(&root->fs_info->volume_mutex);

	sizestr = vol_args->name;
@@ -412,11 +410,8 @@ static noinline int btrfs_ioctl_snap_create(struct btrfs_root *root, 
		goto out;

	}



	vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';

	namelen = strlen(vol_args->name);

	if (namelen > BTRFS_VOL_NAME_MAX) {

		ret = -EINVAL;

		goto out;

	}

	if (strchr(vol_args->name, '/')) {

		ret = -EINVAL;

		goto out;
@@ -487,6 +482,7 @@ long btrfs_ioctl_add_dev(struct btrfs_root *root, void __user *arg) 
		ret = -EFAULT;

		goto out;

	}

	vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';

	ret = btrfs_init_new_device(root, vol_args->name);



out:
@@ -508,6 +504,7 @@ long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg) 
		ret = -EFAULT;

		goto out;

	}

	vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';

	ret = btrfs_rm_device(root, vol_args->name);



out: