From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 756FCC433FE for ; Tue, 18 Oct 2022 00:11:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231466AbiJRALm (ORCPT ); Mon, 17 Oct 2022 20:11:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36994 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231209AbiJRAK3 (ORCPT ); Mon, 17 Oct 2022 20:10:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF9AF876AB; Mon, 17 Oct 2022 17:08:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 281E4612A3; Tue, 18 Oct 2022 00:08:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF651C433D6; Tue, 18 Oct 2022 00:08:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1666051728; bh=u7idk/ZoROxyb7r/W1xgclN0NS4lJ3I+fbjdehzzKV0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dQLB0N5YfRB8czqEfkw5Gvg5oD248IXf/B4khLrL6zVmxfWeptwtVXPnQzwNjtGZO 9L+ik/JuBQHJ3KzjHgSDpnWG9tckEHfoPze1fnMPB+ao6Xx/Y6wziVLGEbsJZwF+bd dQmHhvfvZt+BUtGOH4QO/OlLPtki0S0poaam0XVevBUdKnvdWp/16wi4R/ZEavAawA Vf2FFZGKzpLUQ/5rSeMdjHm5d6hq0DDmwMP7W7RfLkATcgY43YHofr/REM8WfRprwG bogvKYyfZrKcC0GDP+hjPNtOBYRRM4IuVqF02lZDAU5GPjiZHvPao21jkhzX7wolq+ 9M5Py78PGV9SA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Andreas Gruenbacher , Wolfram Sang , Sasha Levin , rpeterso@redhat.com, cluster-devel@redhat.com Subject: [PATCH AUTOSEL 5.19 04/29] gfs2: Switch from strlcpy to strscpy Date: Mon, 17 Oct 2022 20:08:13 -0400 Message-Id: <20221018000839.2730954-4-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221018000839.2730954-1-sashal@kernel.org> References: <20221018000839.2730954-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Andreas Gruenbacher [ Upstream commit 204c0300c4e99707e9fb6e57840aa1127060e63f ] Switch from strlcpy to strscpy and make sure that @count is the size of the smaller of the source and destination buffers. This prevents reading beyond the end of the source buffer when the source string isn't null terminated. Found by a modified version of syzkaller. Suggested-by: Wolfram Sang Signed-off-by: Andreas Gruenbacher Signed-off-by: Sasha Levin --- fs/gfs2/ops_fstype.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c index c9b423c874a3..ba4dfef0c15d 100644 --- a/fs/gfs2/ops_fstype.c +++ b/fs/gfs2/ops_fstype.c @@ -383,8 +383,10 @@ static int init_names(struct gfs2_sbd *sdp, int silent) if (!table[0]) table = sdp->sd_vfs->s_id; - strlcpy(sdp->sd_proto_name, proto, GFS2_FSNAME_LEN); - strlcpy(sdp->sd_table_name, table, GFS2_FSNAME_LEN); + BUILD_BUG_ON(GFS2_LOCKNAME_LEN > GFS2_FSNAME_LEN); + + strscpy(sdp->sd_proto_name, proto, GFS2_LOCKNAME_LEN); + strscpy(sdp->sd_table_name, table, GFS2_LOCKNAME_LEN); table = sdp->sd_table_name; while ((table = strchr(table, '/'))) @@ -1441,13 +1443,13 @@ static int gfs2_parse_param(struct fs_context *fc, struct fs_parameter *param) switch (o) { case Opt_lockproto: - strlcpy(args->ar_lockproto, param->string, GFS2_LOCKNAME_LEN); + strscpy(args->ar_lockproto, param->string, GFS2_LOCKNAME_LEN); break; case Opt_locktable: - strlcpy(args->ar_locktable, param->string, GFS2_LOCKNAME_LEN); + strscpy(args->ar_locktable, param->string, GFS2_LOCKNAME_LEN); break; case Opt_hostdata: - strlcpy(args->ar_hostdata, param->string, GFS2_LOCKNAME_LEN); + strscpy(args->ar_hostdata, param->string, GFS2_LOCKNAME_LEN); break; case Opt_spectator: args->ar_spectator = 1; -- 2.35.1 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasha Levin Date: Mon, 17 Oct 2022 20:08:13 -0400 Subject: [Cluster-devel] [PATCH AUTOSEL 5.19 04/29] gfs2: Switch from strlcpy to strscpy In-Reply-To: <20221018000839.2730954-1-sashal@kernel.org> References: <20221018000839.2730954-1-sashal@kernel.org> Message-ID: <20221018000839.2730954-4-sashal@kernel.org> List-Id: To: cluster-devel.redhat.com MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit From: Andreas Gruenbacher [ Upstream commit 204c0300c4e99707e9fb6e57840aa1127060e63f ] Switch from strlcpy to strscpy and make sure that @count is the size of the smaller of the source and destination buffers. This prevents reading beyond the end of the source buffer when the source string isn't null terminated. Found by a modified version of syzkaller. Suggested-by: Wolfram Sang Signed-off-by: Andreas Gruenbacher Signed-off-by: Sasha Levin --- fs/gfs2/ops_fstype.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c index c9b423c874a3..ba4dfef0c15d 100644 --- a/fs/gfs2/ops_fstype.c +++ b/fs/gfs2/ops_fstype.c @@ -383,8 +383,10 @@ static int init_names(struct gfs2_sbd *sdp, int silent) if (!table[0]) table = sdp->sd_vfs->s_id; - strlcpy(sdp->sd_proto_name, proto, GFS2_FSNAME_LEN); - strlcpy(sdp->sd_table_name, table, GFS2_FSNAME_LEN); + BUILD_BUG_ON(GFS2_LOCKNAME_LEN > GFS2_FSNAME_LEN); + + strscpy(sdp->sd_proto_name, proto, GFS2_LOCKNAME_LEN); + strscpy(sdp->sd_table_name, table, GFS2_LOCKNAME_LEN); table = sdp->sd_table_name; while ((table = strchr(table, '/'))) @@ -1441,13 +1443,13 @@ static int gfs2_parse_param(struct fs_context *fc, struct fs_parameter *param) switch (o) { case Opt_lockproto: - strlcpy(args->ar_lockproto, param->string, GFS2_LOCKNAME_LEN); + strscpy(args->ar_lockproto, param->string, GFS2_LOCKNAME_LEN); break; case Opt_locktable: - strlcpy(args->ar_locktable, param->string, GFS2_LOCKNAME_LEN); + strscpy(args->ar_locktable, param->string, GFS2_LOCKNAME_LEN); break; case Opt_hostdata: - strlcpy(args->ar_hostdata, param->string, GFS2_LOCKNAME_LEN); + strscpy(args->ar_hostdata, param->string, GFS2_LOCKNAME_LEN); break; case Opt_spectator: args->ar_spectator = 1; -- 2.35.1