Unverified Commit d1de278f authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7267 block/rnbd-srv: Check for unlikely string overflow 

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/E2KQEQCSGUCO75LZHDVPO5WPUKNLAQFH/ 
 
https://gitee.com/src-openeuler/kernel/issues/I99K1F 
 
Link:https://gitee.com/openeuler/kernel/pulls/7267

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Reviewed-by: default avatarYu Kuai <yukuai3@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 3ca86804 525a838c

drivers/block/rnbd/rnbd-srv.c

+10 −9
Original line number Diff line number Diff line
@@ -591,6 +591,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, 
{

	char *full_path;

	char *a, *b;

	int len;



	full_path = kmalloc(PATH_MAX, GFP_KERNEL);

	if (!full_path)
@@ -602,20 +603,20 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, 
	 */

	a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path));

	if (a) {

		int len = a - dev_search_path;

		len = a - dev_search_path;



		len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len,

			       dev_search_path, srv_sess->sessname, dev_name);

	} else {

		len = snprintf(full_path, PATH_MAX, "%s/%s",

			       dev_search_path, dev_name);

	}

	if (len >= PATH_MAX) {

		pr_err("Too long path: %s, %s, %s\n",

		       dev_search_path, srv_sess->sessname, dev_name);

		kfree(full_path);

		return ERR_PTR(-EINVAL);

	}

	} else {

		snprintf(full_path, PATH_MAX, "%s/%s",

			 dev_search_path, dev_name);

	}



	/* eliminitate duplicated slashes */

	a = strchr(full_path, '/');