Commit 7afb6d8f authored by Andy Shevchenko's avatar Andy Shevchenko Committed by Kees Cook
Browse files

jbd2: Avoid printing outside the boundary of the buffer 



Theoretically possible that "%pg" will take all room for the j_devname
and hence the "-%lu" will go outside the boundary due to unconditional
sprintf() in use. To make this code more robust, replace two sequential
s*printf():s by a single call and then replace forbidden character.
It's possible to do this way, because '/' won't ever be in the result
of "-%lu".

Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230605170553.7835-2-andriy.shevchenko@linux.intel.com
parent 8515e4a7

fs/jbd2/journal.c

+2 −4
Original line number Diff line number Diff line
@@ -1491,7 +1491,6 @@ journal_t *jbd2_journal_init_inode(struct inode *inode) 
{

	journal_t *journal;

	sector_t blocknr;

	char *p;

	int err = 0;



	blocknr = 0;
@@ -1515,9 +1514,8 @@ journal_t *jbd2_journal_init_inode(struct inode *inode) 


	journal->j_inode = inode;

	snprintf(journal->j_devname, sizeof(journal->j_devname),

		 "%pg", journal->j_dev);

	p = strreplace(journal->j_devname, '/', '!');

	sprintf(p, "-%lu", journal->j_inode->i_ino);

		 "%pg-%lu", journal->j_dev, journal->j_inode->i_ino);

	strreplace(journal->j_devname, '/', '!');

	jbd2_stats_proc_init(journal);



	return journal;