2024-02-11 15:20:24

by Daniil Dulov

Subject: [PATCH] afs: Increase buffer size in afs_update_volume_status()

The max length of volume->vid value is 20 characters.
So increase idbuf[] size up to 20 to avoid overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation")
Signed-off-by: Daniil Dulov <[email protected]>
---
fs/afs/volume.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/afs/volume.c b/fs/afs/volume.c
index f84194b791d3..9d0da38bbcf6 100644
--- a/fs/afs/volume.c
+++ b/fs/afs/volume.c
@@ -302,7 +302,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key)
{
struct afs_server_list *new, *old, *discard;
struct afs_vldb_entry *vldb;
- char idbuf[16];
+ char idbuf[19];
int ret, idsz;

_enter("");
--
2.25.1

2024-02-11 17:30:34

by Jeffrey E Altman

Subject: Re: [PATCH] afs: Increase buffer size in afs_update_volume_status()

On 2/11/2024 10:04 AM, Daniil Dulov wrote:
> The max length of volume->vid value is 20 characters.
> So increase idbuf[] size up to 20 to avoid overflow.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation")
> Signed-off-by: Daniil Dulov <[email protected]>
> ---
> fs/afs/volume.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/afs/volume.c b/fs/afs/volume.c
> index f84194b791d3..9d0da38bbcf6 100644
> --- a/fs/afs/volume.c
> +++ b/fs/afs/volume.c
> @@ -302,7 +302,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key)
> {
> struct afs_server_list *new, *old, *discard;
> struct afs_vldb_entry *vldb;
> - char idbuf[16];
> + char idbuf[19];
> int ret, idsz;
>
> _enter("");

Thanks for the patch.

The commit message says idbuf[] is being increased to 20 chars but the
patch only increases it to 19.

Should idbuf[] be 20 or should the commit message be altered?

Jeffrey Altman

2024-02-12 07:38:56

by Daniil Dulov

Subject: RE: [PATCH] afs: Increase buffer size in afs_update_volume_status()

Hello!

Thank you for the review. Yes, idbuf[] shoulf be 20 instead of 19. I'll send the correct patch in a minute.

Daniil Dulov


-----Original Message-----
From: Jeffrey E Altman [mailto:[email protected]]
Sent: Sunday, February 11, 2024 8:24 PM
To: Daniil Dulov <[email protected]>; [email protected]
Cc: Marc Dionne <[email protected]>; David Howells <[email protected]>; [email protected]; [email protected]
Subject: Re: [PATCH] afs: Increase buffer size in afs_update_volume_status()

On 2/11/2024 10:04 AM, Daniil Dulov wrote:
> The max length of volume->vid value is 20 characters.
> So increase idbuf[] size up to 20 to avoid overflow.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching
> and fileserver rotation")
> Signed-off-by: Daniil Dulov <[email protected]>
> ---
> fs/afs/volume.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/afs/volume.c b/fs/afs/volume.c index
> f84194b791d3..9d0da38bbcf6 100644
> --- a/fs/afs/volume.c
> +++ b/fs/afs/volume.c
> @@ -302,7 +302,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key)
> {
> struct afs_server_list *new, *old, *discard;
> struct afs_vldb_entry *vldb;
> - char idbuf[16];
> + char idbuf[19];
> int ret, idsz;
>
> _enter("");

Thanks for the patch.

The commit message says idbuf[] is being increased to 20 chars but the patch only increases it to 19.

Should idbuf[] be 20 or should the commit message be altered?

Jeffrey Altman