linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Paul Menage <pmenage@ensim.com>
To: alan@redhat.com, Jan Kara <jack@suse.cz>
Cc: pmenage@ensim.com, linux-kernel@vger.kernel.org
Subject: [PATCH] 2.2.20: Avoid buffer overrun in quota warning
Date: Thu, 13 Sep 2001 18:50:01 -0700	[thread overview]
Message-ID: <E15hi7F-0004jm-00@pmenage-dt.ensim.com> (raw)


The quota code in several places does an sprintf() to a fixed (75 char) 
buffer, where one of the format arguments is a directory name. If your 
mountpoints have long enough names, this can easily overflow and 
corrupt data following the buffer.

This has been fixed in 2.4, but not in 2.2.20pre. There are three ways 
to fix it:

a) backport the delayed warning code from 2.4, which doesn't use sprintf

b) increase the buffer size

c) limit the %s directives in the sprintf() format string.

Given that 2.2.20 is about to be frozen, this patch takes option b, 
increasing the buffer size to be equal to the maximum directory name 
length passed to mount() (PAGE_SIZE) plus some slop for the rest of the 
string to be printed. Maybe for 2.2.21 it might be worth backporting 
the delayed warning code.

Paul

--- linux.orig/include/linux/quota.h    Tue Jun 12 00:56:52 2001
+++ linux/include/linux/quota.h Thu Sep 13 18:21:23 2001
@@ -155,7 +155,7 @@
  * Maximum length of a message generated in the quota system,
  * that needs to be kicked onto the tty.
  */
-#define MAX_QUOTA_MESSAGE 75
+#define MAX_QUOTA_MESSAGE (PAGE_SIZE + 256)
 
 #define DQ_LOCKED     0x01     /* locked for update */
 #define DQ_WANT       0x02     /* wanted for update */



             reply	other threads:[~2001-09-14  1:51 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2001-09-14  1:50 Paul Menage [this message]
2001-09-14  8:46 ` [PATCH] 2.2.20: Avoid buffer overrun in quota warning Jan Kara
2001-09-14 15:15   ` Paul Menage
2001-10-03 18:11     ` Jan Kara

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=E15hi7F-0004jm-00@pmenage-dt.ensim.com \
    --to=pmenage@ensim.com \
    --cc=alan@redhat.com \
    --cc=jack@suse.cz \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).