[PATCH 5/7] Handle snprintf calulation more graceful in v9fs

[PATCH 5/7] Handle snprintf calulation more graceful in v9fs

[Eric Sesterhenn]

[-- Attachment #1.1: Type: text/plain, Size: 946 bytes --]


snprintf might return a value bigger than limit when the string gets
truncated, which would cause the return value to become bogus.

Signed-off-by: Eric Sesterhenn <eric.sesterhenn@x41-dsec.>
---
 fs/9p/v9fs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 8fb89ddc6cc7..9e7cefc26ad9 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -552,6 +552,10 @@ static ssize_t caches_show(struct kobject *kobj,
 	list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
 		if (v9ses->cachetag) {
 			n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
+			if (n > limit) {
+				count = PAGE_SIZE;
+				break;
+			}
 			if (n < 0) {
 				count = n;
 				break;

-- 
Eric Sesterhenn (Principal Security Consultant)
X41 D-SEC GmbH, Dennewartstr. 25-27, D-52068 Aachen
T: +49 241 9809418-0, Fax: -9
Unternehmenssitz: Aachen, Amtsgericht Aachen: HRB19989
Geschäftsführer: Markus Vervier


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]