Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d03f918a authored by Stefan Behrens's avatar Stefan Behrens Committed by Josef Bacik
Browse files

Btrfs: Don't trust the superblock label and simply printk("%s") it 



Someone who is root or capable(CAP_SYS_ADMIN) could corrupt the
superblock and make Btrfs printk("%s") crash while holding the
uuid_mutex since nobody forces a limit on the string. Since the
uuid_mutex is significant, the system would be unusable
afterwards.

Signed-off-by: default avatarStefan Behrens <sbehrens@giantdisaster.de>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.cz>
Signed-off-by: default avatarChris Mason <chris.mason@fusionio.com>
parent 109f2365

fs/btrfs/volumes.c

+5 −2
Original line number Diff line number Diff line
@@ -764,10 +764,13 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder, 
	devid = btrfs_stack_device_id(&disk_super->dev_item);

	transid = btrfs_super_generation(disk_super);

	total_devices = btrfs_super_num_devices(disk_super);

	if (disk_super->label[0])

	if (disk_super->label[0]) {

		if (disk_super->label[BTRFS_LABEL_SIZE - 1])

			disk_super->label[BTRFS_LABEL_SIZE - 1] = '\0';

		printk(KERN_INFO "device label %s ", disk_super->label);

	else

	} else {

		printk(KERN_INFO "device fsid %pU ", disk_super->fsid);

	}

	printk(KERN_CONT "devid %llu transid %llu %s\n",

	       (unsigned long long)devid, (unsigned long long)transid, path);

	ret = device_list_add(path, disk_super, devid, fs_devices_ret);