path name lengths

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I was trying to set up a somewhat perverse test to look at the cost of
using LVMs on Linux, by stacking them many levels deep. When I ran fio,
it crashed before exiting, reporting memory corruption.

I've found a couple issues still present in today's git sources:

The path array in struct disk_util is only 256 bytes long, and there's
no check to avoid overflowing it, so if the string you try to put into
it is
"/sys/block/dm-47/slaves/../../dm-46/slaves/../../dm-45/slaves/../.."
(you get the idea), you can easily scribble past the end of the array,
and the containing disk_util structure.

I'll have a patch for this shortly.

In find_add_disk_slaves, where the code uses readlink on entries found
in the "slaves" subdirectory and appends to the previous directory name,
there is no check for exceeding the size of the automatic character
arrays. Since those arrays are 4KB I'm not having any problems with
them, but it might be good to add checks there.

Ken
--
To unsubscribe from this list: send the line "unsubscribe fio" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel]     [Linux SCSI]     [Linux IDE]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux SCSI]

  Powered by Linux