Patch "lib: update single-char callers of strtobool()" has been added to the 4.4-stable tree
This is a note to let you know that I've just added the patch titled
lib: update single-char callers of strtobool()
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
lib-update-single-char-callers-of-strtobool.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
1404297ebf76fd91a41de215fc8c94c2619e5fdbMon Sep 17 00:00:00 2001
From: Kees Cook <[email protected]>
Date: Thu, 17 Mar 2016 14:22:54 -0700
Subject: lib: update single-char callers of strtobool()
From: Kees Cook <[email protected]>
commit 1404297ebf76fd91a41de215fc8c94c2619e5fdb upstream.
Some callers of strtobool() were passing a pointer to unterminated strings. In preparation of adding multi-character processing to kstrtobool(), update the callers to not pass single-character pointers, and switch to using the new kstrtobool_from_user() helper where possible.
--- fs/cifs/cifs_debug.c | 56 ++++++++++++--------------------------------------- fs/cifs/cifs_debug.h | 2 - fs/cifs/cifsfs.c | 6 ++--- fs/cifs/cifsglob.h | 4 +-- 4 files changed, 20 insertions(+), 48 deletions(-)
fs/cifs/cifs_debug.c +14 -42
@@ -255,7 +255,6 @@ static const struct file_operations cifsstatic ssize_t cifs_stats_proc_write (struct file *file,const char __user *buffer,size_t count,loff_t *ppos) { -char c;bool bv;int rc;struct list_head *tmp1, *tmp2, *tmp3;
@@ -263,11 +262,8 @@ static ssize_t cifs_stats_proc_write(strstruct cifs_ses *ses;struct cifs_tcon *tcon; - rc =get_user (c, buffer); -if (rc) -return rc; - -if (strtobool (&c, &bv) ==0 ) { + rc =kstrtobool_from_user (buffer, count, &bv); +if (rc ==0 ) {#ifdef CONFIG_CIFS_STATS2 atomic_set (&totBufAllocCount,0 );atomic_set (&totSmBufAllocCount,0 );
@@ -290,6 +286,8 @@ static ssize_t cifs_stats_proc_write(str } }spin_unlock (&cifs_tcp_ses_lock); + }else { +return rc; }return count;
@@ -433,17 +431,17 @@ static int cifsFYI_proc_open(struct inodstatic ssize_t cifsFYI_proc_write (struct file *file,const char __user *buffer,size_t count,loff_t *ppos) { -char c; +char c[2 ] = {'\0' };bool bv;int rc; - rc =get_user (c, buffer); + rc =get_user (c[0 ], buffer);if (rc)return rc; -if (strtobool (&c, &bv) ==0 ) +if (strtobool (c, &bv) ==0 ) cifsFYI = bv; -else if ((c >'1' ) && (c <='9' )) - cifsFYI = (int ) (c -'0' );/* see cifs_debug.h for meanings */ +else if ((c[0 ] >'1' ) && (c[0 ] <='9' )) + cifsFYI = (int ) (c[0 ] -'0' );/* see cifs_debug.h for meanings */ return count; }
@@ -471,20 +469,12 @@ static int cifs_linux_ext_proc_open(strustatic ssize_t cifs_linux_ext_proc_write (struct file *file,const char __user *buffer,size_t count,loff_t *ppos) { -char c; -bool bv;int rc; - rc =get_user (c, buffer); + rc =kstrtobool_from_user (buffer, count, &linuxExtEnabled);if (rc)return rc; - rc =strtobool (&c, &bv); -if (rc) -return rc; - - linuxExtEnabled = bv; -return count; }
@@ -511,20 +501,12 @@ static int cifs_lookup_cache_proc_open(sstatic ssize_t cifs_lookup_cache_proc_write (struct file *file,const char __user *buffer,size_t count,loff_t *ppos) { -char c; -bool bv;int rc; - rc =get_user (c, buffer); + rc =kstrtobool_from_user (buffer, count, &lookupCacheEnabled);if (rc)return rc; - rc =strtobool (&c, &bv); -if (rc) -return rc; - - lookupCacheEnabled = bv; -return count; }
@@ -551,20 +533,12 @@ static int traceSMB_proc_open(struct inostatic ssize_t traceSMB_proc_write (struct file *file,const char __user *buffer,size_t count,loff_t *ppos) { -char c; -bool bv;int rc; - rc =get_user (c, buffer); + rc =kstrtobool_from_user (buffer, count, &traceSMB);if (rc)return rc; - rc =strtobool (&c, &bv); -if (rc) -return rc; - - traceSMB = bv; -return count; }
@@ -622,7 +596,6 @@ static ssize_t cifs_security_flags_proc_int rc;unsigned int flags;char flags_string[12 ]; -char c;bool bv;if ((count <1 ) || (count >11 ))
@@ -635,11 +608,10 @@ static ssize_t cifs_security_flags_proc_if (count <3 ) {/* single char or single char followed by null */ - c = flags_string[0 ]; -if (strtobool (&c, &bv) ==0 ) { +if (strtobool (flags_string, &bv) ==0 ) { global_secflags = bv ?CIFSSEC_MAX :CIFSSEC_DEF ;return count; - }else if (!isdigit (c)) { + }else if (!isdigit (flags_string[0 ])) {cifs_dbg (VFS ,"Invalid SecurityFlags: %s\n" , flags_string);return -EINVAL ;
fs/cifs/cifs_debug.h +1 -1
@@ -25,7 +25,7 @@void cifs_dump_mem (char *label,void *data,int length);void cifs_dump_detail (void *);void cifs_dump_mids (struct TCP_Server_Info *); -extern int traceSMB;/* flag which enables the function below */ +extern bool traceSMB;/* flag which enables the function below */ void dump_smb (void *,int );#define CIFS_INFO 0x01#define CIFS_RC 0x02
fs/cifs/cifsfs.c +3 -3
@@ -54,10 +54,10 @@#endif int cifsFYI =0 ; -int traceSMB =0 ; +bool traceSMB;bool enable_oplocks = true; -unsigned int linuxExtEnabled =1 ; -unsigned int lookupCacheEnabled =1 ; +bool linuxExtEnabled = true; +bool lookupCacheEnabled = true;unsigned int global_secflags =CIFSSEC_DEF ;/* unsigned int ntlmv2_support = 0; */ unsigned int sign_CIFS_PDUs =1 ;
fs/cifs/cifsglob.h +2 -2
@@ -1588,11 +1588,11 @@ GLOBAL_EXTERN atomic_t midCount;/* Misc globals */ GLOBAL_EXTERN bool enable_oplocks; /* enable or disable oplocks */ -GLOBAL_EXTERN unsigned int lookupCacheEnabled; +GLOBAL_EXTERN bool lookupCacheEnabled; GLOBAL_EXTERN unsigned int global_secflags; /* if on, session setup sentwith more secure ntlmssp2 challenge/resp */ GLOBAL_EXTERN unsigned int sign_CIFS_PDUs; /* enable smb packet signing */ -GLOBAL_EXTERN unsigned int linuxExtEnabled;/*enable Linux/Unix CIFS extensions*/ +GLOBAL_EXTERN bool linuxExtEnabled;/*enable Linux/Unix CIFS extensions*/ GLOBAL_EXTERN unsigned int CIFSMaxBufSize; /* max size not including hdr */ GLOBAL_EXTERN unsigned int cifs_min_rcv; /* min size of big ntwrk buf pool */ GLOBAL_EXTERN unsigned int cifs_min_small; /* min size of small buf pool */
Patches currently in stable-queue which might be from [email protected] are
queue-4.4/ovl-fix-info-leak-in-ovl_lookup_temp.patch queue-4.4/lib-update-single-char-callers-of-strtobool.patch queue-4.4/pstore-ram-use-memcpy_toio-instead-of-memcpy.patch queue-4.4/pstore-core-drop-cmpxchg-based-updates.patch queue-4.4/pstore-ramoops-fixup-driver-removal.patch queue-4.4/lib-add-on-off-support-to-kstrtobool.patch queue-4.4/pstore-ram-use-memcpy_fromio-to-save-old-buffer.patch queue-4.4/lib-move-strtobool-to-kstrtobool.patch