Btrfs: ensure path name is null terminated at btrfs_control_ioctl
PATCH 1/1 Btrfs: ensure path name is null terminated at btrfs_control_ioctl
From: Filipe Manana <[email protected]>
We were using the path name received from user space without checking that it is null terminated. While btrfs-progs is well behaved and does proper validation and null termination, someone could call the ioctl and pass a non-null terminated patch, leading to buffer overrun problems in the kernel.
So just set the last byte of the path to a null character, similar to what we do in other ioctls (add/remove/resize device, snapshot creation, etc).
--- fs/btrfs/super.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/super.c +1 -0
@@ -2235,6 +2235,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd, vol =memdup_user ((void __user *)arg,sizeof (*vol));if (IS_ERR (vol))return PTR_ERR (vol); + vol->name[BTRFS_PATH_NAME_MAX ] ='\0' ;switch (cmd) {case BTRFS_IOC_SCAN_DEV :
Signature · 1 line
2.11.0
Quoted 8 lines · On 11/14/2018 07:35 PM, [email protected] wrote:
From: Filipe Manana <[email protected]>
We were using the path name received from user space without checking that it is null terminated. While btrfs-progs is well behaved and does proper validation and null termination, someone could call the ioctl and pass a non-null terminated patch, leading to buffer overrun problems in the kernel.
Quoted 4 lines
So just set the last byte of the path to a null character, similar to what we do in other ioctls (add/remove/resize device, snapshot creation, etc).
Signed-off-by Filipe Manana <[email protected]>
Thanks, Anand
Quoted 17 lines
--- fs/btrfs/super.c | 1 + 1 file changed, 1 insertion(+)fs/btrfs/super.c +1
-0@@ -2235,6 +2235,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd, vol =memdup_user ((void __user *)arg,sizeof (*vol));if (IS_ERR (vol))return PTR_ERR (vol); + vol->name[BTRFS_PATH_NAME_MAX ] ='\0' ;switch (cmd) {case BTRFS_IOC_SCAN_DEV :
Quoted 8 lines · On Wed, Nov 14, 2018 at 11:35:24AM +0000, [email protected] wrote:
From: Filipe Manana <[email protected]>
We were using the path name received from user space without checking that it is null terminated. While btrfs-progs is well behaved and does proper validation and null termination, someone could call the ioctl and pass a non-null terminated patch, leading to buffer overrun problems in the kernel.
Quoted 4 lines
So just set the last byte of the path to a null character, similar to what we do in other ioctls (add/remove/resize device, snapshot creation, etc).
Signed-off-by Filipe Manana <[email protected]>
Good catch, thanks