forked from luck/tmp_suning_uos_patched
b32a09db4f
match_strcpy() is a somewhat creepy function: the caller needs to make sure that the destination buffer is big enough, and when he screws up or forgets, match_strcpy() happily overruns the buffer. There's exactly one customer: v9fs_parse_options(). I believe it currently can't overflow its buffer, but that's not exactly obvious. The source string is a substing of the mount options. The kernel silently truncates those to PAGE_SIZE bytes, including the terminating zero. See compat_sys_mount() and do_mount(). The destination buffer is obtained from __getname(), which allocates from name_cachep, which is initialized by vfs_caches_init() for size PATH_MAX. We're safe as long as PATH_MAX <= PAGE_SIZE. PATH_MAX is 4096. As far as I know, the smallest PAGE_SIZE is also 4096. Here's a patch that makes the code a bit more obviously correct. It doesn't depend on PATH_MAX <= PAGE_SIZE. Signed-off-by: Markus Armbruster <armbru@redhat.com> Cc: Latchesar Ionkov <lucho@ionkov.net> Cc: Jim Meyering <meyering@redhat.com> Cc: "Randy.Dunlap" <rdunlap@xenotime.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com> |
||
|---|---|---|
| .. | ||
| lzo | ||
| reed_solomon | ||
| zlib_deflate | ||
| zlib_inflate | ||
| .gitignore | ||
| argv_split.c | ||
| audit.c | ||
| bitmap.c | ||
| bitrev.c | ||
| bug.c | ||
| bust_spinlocks.c | ||
| check_signature.c | ||
| cmdline.c | ||
| cpumask.c | ||
| crc-ccitt.c | ||
| crc-itu-t.c | ||
| crc7.c | ||
| crc16.c | ||
| crc32.c | ||
| crc32defs.h | ||
| ctype.c | ||
| debug_locks.c | ||
| debugobjects.c | ||
| dec_and_lock.c | ||
| devres.c | ||
| div64.c | ||
| dump_stack.c | ||
| extable.c | ||
| fault-inject.c | ||
| find_next_bit.c | ||
| gen_crc32table.c | ||
| genalloc.c | ||
| halfmd4.c | ||
| hexdump.c | ||
| hweight.c | ||
| idr.c | ||
| inflate.c | ||
| int_sqrt.c | ||
| iomap_copy.c | ||
| iomap.c | ||
| iommu-helper.c | ||
| ioremap.c | ||
| irq_regs.c | ||
| kasprintf.c | ||
| Kconfig | ||
| Kconfig.debug | ||
| Kconfig.kgdb | ||
| kernel_lock.c | ||
| klist.c | ||
| kobject_uevent.c | ||
| kobject.c | ||
| kref.c | ||
| libcrc32c.c | ||
| list_debug.c | ||
| lmb.c | ||
| locking-selftest-hardirq.h | ||
| locking-selftest-mutex.h | ||
| locking-selftest-rlock-hardirq.h | ||
| locking-selftest-rlock-softirq.h | ||
| locking-selftest-rlock.h | ||
| locking-selftest-rsem.h | ||
| locking-selftest-softirq.h | ||
| locking-selftest-spin-hardirq.h | ||
| locking-selftest-spin-softirq.h | ||
| locking-selftest-spin.h | ||
| locking-selftest-wlock-hardirq.h | ||
| locking-selftest-wlock-softirq.h | ||
| locking-selftest-wlock.h | ||
| locking-selftest-wsem.h | ||
| locking-selftest.c | ||
| Makefile | ||
| parser.c | ||
| percpu_counter.c | ||
| plist.c | ||
| prio_heap.c | ||
| prio_tree.c | ||
| proportions.c | ||
| radix-tree.c | ||
| random32.c | ||
| ratelimit.c | ||
| rbtree.c | ||
| reciprocal_div.c | ||
| rwsem-spinlock.c | ||
| rwsem.c | ||
| scatterlist.c | ||
| sha1.c | ||
| smp_processor_id.c | ||
| sort.c | ||
| spinlock_debug.c | ||
| string.c | ||
| swiotlb.c | ||
| textsearch.c | ||
| ts_bm.c | ||
| ts_fsm.c | ||
| ts_kmp.c | ||
| vsprintf.c | ||