Btrfs: Null terminate strings passed in from userspace (5516e595) · Commits · 戴 / test

The 'char name[BTRFS_PATH_NAME_MAX]' member of struct btrfs_ioctl_vol_args is passed directly to strlen() after being copied from user. I haven't verified this, but in theory a userspace program could pass in an unterminated string and cause a kernel crash as strlen walks off the end of the array. This patch terminates the ->name string in all btrfs ioctl functions which currently use a 'struct btrfs_ioctl_vol_args'. Since the string is now properly terminated, it's length will never be longer than BTRFS_PATH_NAME_MAX so that error check has been removed. By the way, it might be better overall to just have the ioctl pass an unterminated string + length structure but I didn't bother with that since it'd change the kernel/user interface. Signed-off-by:

Mark Fasheh <mfasheh@suse.com> Signed-off-by:

Chris Mason <chris.mason@oracle.com>

fs/btrfs/ioctl.c

+5 −8

Original line number	Diff line number	Diff line
		@@ -310,11 +310,9 @@ static int btrfs_ioctl_resize(struct btrfs_root root, void __user arg)
		ret = -EFAULT;
		goto out;
		}

		vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
		namelen = strlen(vol_args->name);
		if (namelen > BTRFS_VOL_NAME_MAX) {
		ret = -EINVAL;
		goto out;
		}

		mutex_lock(&root->fs_info->volume_mutex);
		sizestr = vol_args->name;
		@@ -412,11 +410,8 @@ static noinline int btrfs_ioctl_snap_create(struct btrfs_root *root,
		goto out;
		}

		vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
		namelen = strlen(vol_args->name);
		if (namelen > BTRFS_VOL_NAME_MAX) {
		ret = -EINVAL;
		goto out;
		}
		if (strchr(vol_args->name, '/')) {
		ret = -EINVAL;
		goto out;
		@@ -487,6 +482,7 @@ long btrfs_ioctl_add_dev(struct btrfs_root root, void __user arg)
		ret = -EFAULT;
		goto out;
		}
		vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
		ret = btrfs_init_new_device(root, vol_args->name);

		out:
		@@ -508,6 +504,7 @@ long btrfs_ioctl_rm_dev(struct btrfs_root root, void __user arg)
		ret = -EFAULT;
		goto out;
		}
		vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
		ret = btrfs_rm_device(root, vol_args->name);

		out:

Admin message