btrfs: array overflow in btrfs_ioctl_rm_dev_v2()
diff mbox

Message ID 20160218050109.GA7781@mwanda
State New
Headers show

Commit Message

Dan Carpenter Feb. 18, 2016, 5:01 a.m. UTC
We were putting the NUL terminator at BTRFS_PATH_NAME_MAX (4087) bytes
instead of BTRFS_SUBVOL_NAME_MAX (4039) so it corrupted memory.

Fixes: 22af1a869288 ('btrfs: introduce device delete by devid')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Anand Jain Feb. 18, 2016, 7:14 a.m. UTC | #1
Thanks Dan.
  Chris pointed out as well. We are working on it..
  Just one concern when device is added the max device length is
  BTRFS_PATH_NAME_MAX. However below fix is proper from the vol_args
  perspective.

Thanks,  Anand


On 02/18/2016 01:01 PM, Dan Carpenter wrote:
> We were putting the NUL terminator at BTRFS_PATH_NAME_MAX (4087) bytes
> instead of BTRFS_SUBVOL_NAME_MAX (4039) so it corrupted memory.
>
> Fixes: 22af1a869288 ('btrfs: introduce device delete by devid')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 5224fc8..77c61b4 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -2700,7 +2700,7 @@ static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg)
>   	if (vol_args->flags & BTRFS_DEVICE_SPEC_BY_ID) {
>   		ret = btrfs_rm_device(root, NULL, vol_args->devid);
>   	} else {
> -		vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
> +		vol_args->name[BTRFS_SUBVOL_NAME_MAX] = '\0';
>   		ret = btrfs_rm_device(root, vol_args->name, 0);
>   	}
>   	mutex_unlock(&root->fs_info->volume_mutex);
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Sterba Feb. 18, 2016, 8:58 a.m. UTC | #2
On Thu, Feb 18, 2016 at 03:14:04PM +0800, Anand Jain wrote:
> 
> 
> Thanks Dan.
>   Chris pointed out as well. We are working on it..

In for next since yesterday.

>   Just one concern when device is added the max device length is
>   BTRFS_PATH_NAME_MAX. However below fix is proper from the vol_args
>   perspective.

Yeah, there's mess in the various PATH constants, but they're all > 4000
and that should be enough for most uses.
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 5224fc8..77c61b4 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2700,7 +2700,7 @@  static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg)
 	if (vol_args->flags & BTRFS_DEVICE_SPEC_BY_ID) {
 		ret = btrfs_rm_device(root, NULL, vol_args->devid);
 	} else {
-		vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
+		vol_args->name[BTRFS_SUBVOL_NAME_MAX] = '\0';
 		ret = btrfs_rm_device(root, vol_args->name, 0);
 	}
 	mutex_unlock(&root->fs_info->volume_mutex);