admin/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-12-07 20:06:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()

Browse Source 
Unlike other strings in the ext4 superblock, we rely on tune2fs to
make sure s_mount_opts is NUL terminated.  Harden
parse_apply_sb_mount_options() by treating s_mount_opts as a potential
__nonstring.

Cc: stable@vger.kernel.org
Fixes: 8b67f04ab9 ("ext4: Add mount options in superblock")
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Message-ID: <20250916-tune2fs-v2-1-d594dc7486f0@mit.edu>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
This commit is contained in:
Theodore Ts'o
2025-09-16 23:22:47 -04:00
parent 12e803c882
commit 8ecb790ea8
1 changed files with 5 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
fs/ext4/super.c
View File

@@ -2469,7 +2469,7 @@ static int parse_apply_sb_mount_options(struct super_block *sb,
struct ext4_fs_context *m_ctx) struct ext4_fs_context *m_ctx)
{ {
struct ext4_sb_info *sbi = EXT4_SB(sb); struct ext4_sb_info *sbi = EXT4_SB(sb);
char *s_mount_opts = NULL; char s_mount_opts[65];
struct ext4_fs_context *s_ctx = NULL; struct ext4_fs_context *s_ctx = NULL;
struct fs_context *fc = NULL; struct fs_context *fc = NULL;
int ret = -ENOMEM; int ret = -ENOMEM;
@@ -2477,15 +2477,11 @@ static int parse_apply_sb_mount_options(struct super_block *sb,
if (!sbi->s_es->s_mount_opts[0]) if (!sbi->s_es->s_mount_opts[0])
return 0; return 0;
s_mount_opts = kstrndup(sbi->s_es->s_mount_opts, strscpy_pad(s_mount_opts, sbi->s_es->s_mount_opts);
sizeof(sbi->s_es->s_mount_opts),
GFP_KERNEL);
if (!s_mount_opts)
return ret;
fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL); fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL);
if (!fc) if (!fc)
goto out_free; return -ENOMEM;
s_ctx = kzalloc(sizeof(struct ext4_fs_context), GFP_KERNEL); s_ctx = kzalloc(sizeof(struct ext4_fs_context), GFP_KERNEL);
if (!s_ctx) if (!s_ctx)
@@ -2517,11 +2513,8 @@ parse_failed:
ret = 0; ret = 0;
out_free: out_free:
if (fc) {
ext4_fc_free(fc); ext4_fc_free(fc);
kfree(fc); kfree(fc);
}
kfree(s_mount_opts);
return ret; return ret;
} }