2018-09-14 10:15:10

by Dongbo Cao

Subject: [PATCH 2/2] add some safety checks for label store interface of flash dev in sysfs

do some checks on the label's length and ending.

Signed-off-by: Dongbo Cao <[email protected]>
---
drivers/md/bcache/sysfs.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index e64c718f..cce793ef 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -447,8 +447,15 @@ STORE(__bch_flash_dev)
}

if (attr == &sysfs_label) {
+ if (size > SB_LABEL_SIZE)
+ return -EINVAL;
memcpy(u->label, buf, SB_LABEL_SIZE);
- bch_uuid_write(d->c);
+ if (size < SB_LABEL_SIZE)
+ u->label[size] = '\0';
+ if (size && u->label[size - 1] == '\n')
+ u->label[size - 1] = '\0';
+ if(d->c)
+ bch_uuid_write(d->c);
}

if (attr == &sysfs_unregister) {
--
2.17.1

2018-09-15 01:22:48

by Junhui Tang

Subject: Re: [PATCH 2/2] add some safety checks for label store interface of flash dev in sysfs

Seems something wrong
when size = SB_LABEL_SIZE and u->label[size - 1] != '\n'
please check again.

---------------------------------------------------------------------------
Tang Junhui
Forever me is me
---------------------------------------------------------------------------

Dongbo Cao <[email protected]> 于2018年9月14日周五 下午6:13写道：
>
> do some checks on the label's length and ending.
>
> Signed-off-by: Dongbo Cao <[email protected]>
> ---
> drivers/md/bcache/sysfs.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
> index e64c718f..cce793ef 100644
> --- a/drivers/md/bcache/sysfs.c
> +++ b/drivers/md/bcache/sysfs.c
> @@ -447,8 +447,15 @@ STORE(__bch_flash_dev)
> }
>
> if (attr == &sysfs_label) {
> + if (size > SB_LABEL_SIZE)
> + return -EINVAL;
> memcpy(u->label, buf, SB_LABEL_SIZE);
> - bch_uuid_write(d->c);
> + if (size < SB_LABEL_SIZE)
> + u->label[size] = '\0';
> + if (size && u->label[size - 1] == '\n')
> + u->label[size - 1] = '\0';
> + if(d->c)
> + bch_uuid_write(d->c);
> }
>
> if (attr == &sysfs_unregister) {
> --
> 2.17.1
>
>