From: Filipe Manana Date: Wed, 14 Nov 2018 11:35:24 +0000 (+0000) Subject: Btrfs: ensure path name is null terminated at btrfs_control_ioctl X-Git-Tag: v4.14.86~34 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=52fa8eaac8149594d57bd4fe0cfeaa329037d400;p=platform%2Fkernel%2Flinux-rpi.git Btrfs: ensure path name is null terminated at btrfs_control_ioctl commit f505754fd6599230371cb01b9332754ddc104be1 upstream. We were using the path name received from user space without checking that it is null terminated. While btrfs-progs is well behaved and does proper validation and null termination, someone could call the ioctl and pass a non-null terminated patch, leading to buffer overrun problems in the kernel. The ioctl is protected by CAP_SYS_ADMIN. So just set the last byte of the path to a null character, similar to what we do in other ioctls (add/remove/resize device, snapshot creation, etc). CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c index fe960d5..49a02bf 100644 --- a/fs/btrfs/super.c +++ b/fs/btrfs/super.c @@ -2176,6 +2176,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd, vol = memdup_user((void __user *)arg, sizeof(*vol)); if (IS_ERR(vol)) return PTR_ERR(vol); + vol->name[BTRFS_PATH_NAME_MAX] = '\0'; switch (cmd) { case BTRFS_IOC_SCAN_DEV: