jbd2: Avoid printing outside the boundary of the buffer
authorAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Mon, 5 Jun 2023 17:05:51 +0000 (20:05 +0300)
committerKees Cook <keescook@chromium.org>
Mon, 5 Jun 2023 22:31:12 +0000 (15:31 -0700)
commit7afb6d8fa81fd8d332f70ead5e35d8c90abb8165
treec843ef681c8a20274965d8c4482ee2e1ba9ef680
parent8515e4a746fcb888fa6c320242eccf4c1d402465
jbd2: Avoid printing outside the boundary of the buffer

Theoretically possible that "%pg" will take all room for the j_devname
and hence the "-%lu" will go outside the boundary due to unconditional
sprintf() in use. To make this code more robust, replace two sequential
s*printf():s by a single call and then replace forbidden character.
It's possible to do this way, because '/' won't ever be in the result
of "-%lu".

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230605170553.7835-2-andriy.shevchenko@linux.intel.com
fs/jbd2/journal.c