Skip to content

Commit 204c030

Browse files
author
Andreas Gruenbacher
committed
gfs2: Switch from strlcpy to strscpy
Switch from strlcpy to strscpy and make sure that @count is the size of the smaller of the source and destination buffers. This prevents reading beyond the end of the source buffer when the source string isn't null terminated. Found by a modified version of syzkaller. Suggested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
1 parent 8693419 commit 204c030

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

fs/gfs2/ops_fstype.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -381,8 +381,10 @@ static int init_names(struct gfs2_sbd *sdp, int silent)
381381
if (!table[0])
382382
table = sdp->sd_vfs->s_id;
383383

384-
strlcpy(sdp->sd_proto_name, proto, GFS2_FSNAME_LEN);
385-
strlcpy(sdp->sd_table_name, table, GFS2_FSNAME_LEN);
384+
BUILD_BUG_ON(GFS2_LOCKNAME_LEN > GFS2_FSNAME_LEN);
385+
386+
strscpy(sdp->sd_proto_name, proto, GFS2_LOCKNAME_LEN);
387+
strscpy(sdp->sd_table_name, table, GFS2_LOCKNAME_LEN);
386388

387389
table = sdp->sd_table_name;
388390
while ((table = strchr(table, '/')))
@@ -1439,13 +1441,13 @@ static int gfs2_parse_param(struct fs_context *fc, struct fs_parameter *param)
14391441

14401442
switch (o) {
14411443
case Opt_lockproto:
1442-
strlcpy(args->ar_lockproto, param->string, GFS2_LOCKNAME_LEN);
1444+
strscpy(args->ar_lockproto, param->string, GFS2_LOCKNAME_LEN);
14431445
break;
14441446
case Opt_locktable:
1445-
strlcpy(args->ar_locktable, param->string, GFS2_LOCKNAME_LEN);
1447+
strscpy(args->ar_locktable, param->string, GFS2_LOCKNAME_LEN);
14461448
break;
14471449
case Opt_hostdata:
1448-
strlcpy(args->ar_hostdata, param->string, GFS2_LOCKNAME_LEN);
1450+
strscpy(args->ar_hostdata, param->string, GFS2_LOCKNAME_LEN);
14491451
break;
14501452
case Opt_spectator:
14511453
args->ar_spectator = 1;

0 commit comments

Comments
 (0)