* [PATCH] dm-ingerity: change memcmp to strncmp
@ 2019-03-13 11:56 Mikulas Patocka
2019-03-13 14:40 ` James Bottomley
0 siblings, 1 reply; 3+ messages in thread
From: Mikulas Patocka @ 2019-03-13 11:56 UTC (permalink / raw)
To: Mike Snitzer; +Cc: dm-devel
If the string opt_string is small, the function memcmp can access bytes
that are beyond the terminating nul character. In theory, it could cause
segfault, if opt_string were located just below some unmapped memory.
This patch changes memcmp to strncmp, so that we don't read bytes beyond
the end of the string.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org # v4.12+
---
drivers/md/dm-integrity.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
Index: linux-2.6/drivers/md/dm-integrity.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-integrity.c 2019-03-12 15:33:17.000000000 +0100
+++ linux-2.6/drivers/md/dm-integrity.c 2019-03-12 15:34:49.000000000 +0100
@@ -3185,7 +3185,7 @@ static int dm_integrity_ctr(struct dm_ta
journal_watermark = val;
else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1)
sync_msec = val;
- else if (!memcmp(opt_string, "meta_device:", strlen("meta_device:"))) {
+ else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) {
if (ic->meta_dev) {
dm_put_device(ti, ic->meta_dev);
ic->meta_dev = NULL;
@@ -3204,17 +3204,17 @@ static int dm_integrity_ctr(struct dm_ta
goto bad;
}
ic->sectors_per_block = val >> SECTOR_SHIFT;
- } else if (!memcmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
+ } else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error,
"Invalid internal_hash argument");
if (r)
goto bad;
- } else if (!memcmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
+ } else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error,
"Invalid journal_crypt argument");
if (r)
goto bad;
- } else if (!memcmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
+ } else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
r = get_alg_and_key(opt_string, &ic->journal_mac_alg, &ti->error,
"Invalid journal_mac argument");
if (r)
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] dm-ingerity: change memcmp to strncmp
2019-03-13 11:56 [PATCH] dm-ingerity: change memcmp to strncmp Mikulas Patocka
@ 2019-03-13 14:40 ` James Bottomley
2019-03-13 15:58 ` Mikulas Patocka
0 siblings, 1 reply; 3+ messages in thread
From: James Bottomley @ 2019-03-13 14:40 UTC (permalink / raw)
To: Mikulas Patocka, Mike Snitzer; +Cc: dm-devel
On Wed, 2019-03-13 at 07:56 -0400, Mikulas Patocka wrote:
> If the string opt_string is small, the function memcmp can access
> bytes
> that are beyond the terminating nul character. In theory, it could
> cause
> segfault, if opt_string were located just below some unmapped memory.
>
> This patch changes memcmp to strncmp, so that we don't read bytes
> beyond
> the end of the string.
>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> Cc: stable@vger.kernel.org # v4.12+
>
> ---
> drivers/md/dm-integrity.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> Index: linux-2.6/drivers/md/dm-integrity.c
> ===================================================================
> --- linux-2.6.orig/drivers/md/dm-integrity.c 2019-03-12
> 15:33:17.000000000 +0100
> +++ linux-2.6/drivers/md/dm-integrity.c 2019-03-12
> 15:34:49.000000000 +0100
> @@ -3185,7 +3185,7 @@ static int dm_integrity_ctr(struct dm_ta
> journal_watermark = val;
> else if (sscanf(opt_string, "commit_time:%u%c",
> &val, &dummy) == 1)
> sync_msec = val;
> - else if (!memcmp(opt_string, "meta_device:",
> strlen("meta_device:"))) {
> + else if (!strncmp(opt_string, "meta_device:",
> strlen("meta_device:"))) {
strncmp(a, b, strlen(b)) is semantically equivalent to strcmp(a,b) but
the latter is far shorter and easier so you should use it.
James
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] dm-ingerity: change memcmp to strncmp
2019-03-13 14:40 ` James Bottomley
@ 2019-03-13 15:58 ` Mikulas Patocka
0 siblings, 0 replies; 3+ messages in thread
From: Mikulas Patocka @ 2019-03-13 15:58 UTC (permalink / raw)
To: James Bottomley; +Cc: Mike Snitzer, dm-devel
On Wed, 13 Mar 2019, James Bottomley wrote:
> On Wed, 2019-03-13 at 07:56 -0400, Mikulas Patocka wrote:
> > If the string opt_string is small, the function memcmp can access
> > bytes
> > that are beyond the terminating nul character. In theory, it could
> > cause
> > segfault, if opt_string were located just below some unmapped memory.
> >
> > This patch changes memcmp to strncmp, so that we don't read bytes
> > beyond
> > the end of the string.
> >
> > Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> > Cc: stable@vger.kernel.org # v4.12+
> >
> > ---
> > drivers/md/dm-integrity.c | 8 ++++----
> > 1 file changed, 4 insertions(+), 4 deletions(-)
> >
> > Index: linux-2.6/drivers/md/dm-integrity.c
> > ===================================================================
> > --- linux-2.6.orig/drivers/md/dm-integrity.c 2019-03-12
> > 15:33:17.000000000 +0100
> > +++ linux-2.6/drivers/md/dm-integrity.c 2019-03-12
> > 15:34:49.000000000 +0100
> > @@ -3185,7 +3185,7 @@ static int dm_integrity_ctr(struct dm_ta
> > journal_watermark = val;
> > else if (sscanf(opt_string, "commit_time:%u%c",
> > &val, &dummy) == 1)
> > sync_msec = val;
> > - else if (!memcmp(opt_string, "meta_device:",
> > strlen("meta_device:"))) {
> > + else if (!strncmp(opt_string, "meta_device:",
> > strlen("meta_device:"))) {
>
> strncmp(a, b, strlen(b)) is semantically equivalent to strcmp(a,b) but
> the latter is far shorter and easier so you should use it.
>
> James
No, it isn't.
strncmp("blabla", "bla", strlen("bla") returns zero.
strcmp("blabla", "bla") reurns a positive number.
Mikulas
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-03-13 15:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-13 11:56 [PATCH] dm-ingerity: change memcmp to strncmp Mikulas Patocka
2019-03-13 14:40 ` James Bottomley
2019-03-13 15:58 ` Mikulas Patocka
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.