lkml.org 
[lkml]   [2021]   [Jan]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 052/152] ext4: dont leak old mountpoint samples
    Date
    From: Theodore Ts'o <tytso@mit.edu>

    [ Upstream commit 5a3b590d4b2db187faa6f06adc9a53d6199fb1f9 ]

    When the first file is opened, ext4 samples the mountpoint of the
    filesystem in 64 bytes of the super block. It does so using
    strlcpy(), this means that the remaining bytes in the super block
    string buffer are untouched. If the mount point before had a longer
    path than the current one, it can be reconstructed.

    Consider the case where the fs was mounted to "/media/johnjdeveloper"
    and later to "/". The super block buffer then contains
    "/\x00edia/johnjdeveloper".

    This case was seen in the wild and caused confusion how the name
    of a developer ands up on the super block of a filesystem used
    in production...

    Fix this by using strncpy() instead of strlcpy(). The superblock
    field is defined to be a fixed-size char array, and it is already
    marked using __nonstring in fs/ext4/ext4.h. The consumer of the field
    in e2fsprogs already assumes that in the case of a 64+ byte mount
    path, that s_last_mounted will not be NUL terminated.

    Link: https://lore.kernel.org/r/X9ujIOJG/HqMr88R@mit.edu
    Reported-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/ext4/file.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/ext4/file.c b/fs/ext4/file.c
    index 3ed8c048fb12c..b692355b8c770 100644
    --- a/fs/ext4/file.c
    +++ b/fs/ext4/file.c
    @@ -809,7 +809,7 @@ static int ext4_sample_last_mounted(struct super_block *sb,
    err = ext4_journal_get_write_access(handle, sbi->s_sbh);
    if (err)
    goto out_journal;
    - strlcpy(sbi->s_es->s_last_mounted, cp,
    + strncpy(sbi->s_es->s_last_mounted, cp,
    sizeof(sbi->s_es->s_last_mounted));
    ext4_handle_dirty_super(handle, sb);
    out_journal:
    --
    2.27.0


    \
     
     \ /
      Last update: 2021-01-18 16:11    [W:4.126 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site