[ndctl PATCH 1/4] libndctl: fix potential buffer overflow in write_cache APIs

[Vishal Verma <vishal.l.verma@intel.com>]

We used a local stack variable to hold the sysfs path, which had a
potential to overflow. Instead, switch to the 'scratch space' bdbs->buf
to store the sysfs path as it is correctly sized for it.

Cc: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
---
 ndctl/lib/libndctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ndctl/lib/libndctl.c b/ndctl/lib/libndctl.c
index 59ea82a..2a3ef0c 100644
--- a/ndctl/lib/libndctl.c
+++ b/ndctl/lib/libndctl.c
@@ -3991,10 +3991,10 @@ static int __ndctl_namespace_set_write_cache(struct ndctl_namespace *ndns,
 {
 	struct ndctl_ctx *ctx = ndctl_namespace_get_ctx(ndns);
 	struct ndctl_pfn *pfn = ndctl_namespace_get_pfn(ndns);
+	char *path = ndns->ndns_buf;
 	char buf[SYSFS_ATTR_SIZE];
 	int len = ndns->buf_len;
 	const char *bdev;
-	char path[50];
 
 	if (state != 1 && state != 0)
 		return -ENXIO;
@@ -4034,9 +4034,9 @@ NDCTL_EXPORT int ndctl_namespace_write_cache_is_enabled(
 	struct ndctl_ctx *ctx = ndctl_namespace_get_ctx(ndns);
 	struct ndctl_pfn *pfn = ndctl_namespace_get_pfn(ndns);
 	int len = ndns->buf_len, wc;
+	char *path = ndns->ndns_buf;
 	char buf[SYSFS_ATTR_SIZE];
 	const char *bdev;
-	char path[50];
 
 	if (pfn)
 		bdev = ndctl_pfn_get_block_device(pfn);
-- 
2.14.3

_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm