Unverified Commit 1d1e27a9 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5431 block/rnbd-srv: Check for unlikely string overflow 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Lingfeng <lilingfeng3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/BZ2R7WAVJDJZYQ6ERUCYKK7KCZP2GFEM/ 
 
https://gitee.com/src-openeuler/kernel/issues/I99K1F 
 
Link:https://gitee.com/openeuler/kernel/pulls/5431

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Reviewed-by: default avatarYu Kuai <yukuai3@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 3cde27e7 3df39e0b

drivers/block/rnbd/rnbd-srv.c

+10 −9
Original line number Diff line number Diff line
@@ -591,6 +591,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, 
{

	char *full_path;

	char *a, *b;

	int len;



	full_path = kmalloc(PATH_MAX, GFP_KERNEL);

	if (!full_path)
@@ -602,20 +603,20 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, 
	 */

	a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path));

	if (a) {

		int len = a - dev_search_path;

		len = a - dev_search_path;



		len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len,

			       dev_search_path, srv_sess->sessname, dev_name);

	} else {

		len = snprintf(full_path, PATH_MAX, "%s/%s",

			       dev_search_path, dev_name);

	}

	if (len >= PATH_MAX) {

		pr_err("Too long path: %s, %s, %s\n",

		       dev_search_path, srv_sess->sessname, dev_name);

		kfree(full_path);

		return ERR_PTR(-EINVAL);

	}

	} else {

		snprintf(full_path, PATH_MAX, "%s/%s",

			 dev_search_path, dev_name);

	}



	/* eliminitate duplicated slashes */

	a = strchr(full_path, '/');