diff options
| author | Stefan Behrens <sbehrens@giantdisaster.de> | 2012-11-05 13:10:49 +0000 |
|---|---|---|
| committer | Josef Bacik <jbacik@fusionio.com> | 2012-12-12 17:15:26 -0500 |
| commit | d03f918ab9036cc71740c0aa796c8e02e6f6f6d3 (patch) | |
| tree | ff6c9ec2d42a9d5e54c640a1ff88f0a8dc4404cf /fs | |
| parent | 109f2365f1928af241b2ccbd0f6ba0b93d911288 (diff) | |
| download | talos-op-linux-d03f918ab9036cc71740c0aa796c8e02e6f6f6d3.tar.gz talos-op-linux-d03f918ab9036cc71740c0aa796c8e02e6f6f6d3.zip | |
Btrfs: Don't trust the superblock label and simply printk("%s") it
Someone who is root or capable(CAP_SYS_ADMIN) could corrupt the
superblock and make Btrfs printk("%s") crash while holding the
uuid_mutex since nobody forces a limit on the string. Since the
uuid_mutex is significant, the system would be unusable
afterwards.
Signed-off-by: Stefan Behrens <sbehrens@giantdisaster.de>
Reviewed-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <chris.mason@fusionio.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/btrfs/volumes.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 3f4bfee66d7b..db79fb7e7e91 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -764,10 +764,13 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder, devid = btrfs_stack_device_id(&disk_super->dev_item); transid = btrfs_super_generation(disk_super); total_devices = btrfs_super_num_devices(disk_super); - if (disk_super->label[0]) + if (disk_super->label[0]) { + if (disk_super->label[BTRFS_LABEL_SIZE - 1]) + disk_super->label[BTRFS_LABEL_SIZE - 1] = '\0'; printk(KERN_INFO "device label %s ", disk_super->label); - else + } else { printk(KERN_INFO "device fsid %pU ", disk_super->fsid); + } printk(KERN_CONT "devid %llu transid %llu %s\n", (unsigned long long)devid, (unsigned long long)transid, path); ret = device_list_add(path, disk_super, devid, fs_devices_ret); |
