Re: [PATCH v1] seq_file: Fix overflow condition in seq_commit

[Al Viro]

On Tue, Aug 20, 2013 at 12:51:56PM +0530, Arun KS wrote:

> d_path expects the pathname to be less than 64 bytes. If its more than
> 64, it returns -ENAMETOOLONG.

?!?!?  d_path() does not expect anything of that sort - it can very
well produce names much longer, without ENAMETOOLONG.

> char *dynamic_dname(struct dentry *dentry, char *buffer, int buflen,
>                         const char *fmt, ...)
> {
>         va_list args;
>         char temp[64];
>         int sz;
> 
>         va_start(args, fmt);
>         sz = vsnprintf(temp, sizeof(temp), fmt, args) + 1;
>         va_end(args);
> 
>         if (sz > sizeof(temp) || sz > buflen)
>                 return ERR_PTR(-ENAMETOOLONG);
> 
>         buffer += buflen - sz;
>         return memcpy(buffer, temp, sz);
> }

Aha.  _That_ is a bug, all right - dynamic_dname() is simply not suitable
for that kind of uses.  ashmem.c is certainly abusing shmem_file_setup();
feeding that kind of mess as dentry name is a Bad Idea(tm).  Anyway,
I'd suggest this for a fix:

	va_list args;
	size_t sz;
	va_start(args, fmt);
	sz = vsnprintf(NULL, 0, fmt, args) + 1;
	va_end(args);
	if (sz > buflen)
		return ERR_PTR(-ENAMETOOLONG);
	va_start(args, fmt);
	buffer += buflen - sz;
	vsprintf(buffer, fmt, args);
	va_end(args);
	return buffer;

Either right in dynamic_dname(), or as possibly_fucking_long_dname(),
to be used by shmem.c...
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/