On Wed 22-03-23 16:12:04, Andy Shevchenko wrote: > Theoretically possible that "%pg" will take all room for the j_devname > and hence the "-%lu" will go out the boundary due to unconditional > sprintf() in use. To make this code more robust, replace two sequential > s*printf():s by a single call and then replace forbidden character. > It's possible to do this way, because '/' won't ever be in the result > of "-%lu". > > Signed-off-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx> Looks good. Feel free to add: Reviewed-by: Jan Kara <jack@xxxxxxx> Honza > --- > fs/jbd2/journal.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c > index 8ae419152ff6..00c0aa4a3a91 100644 > --- a/fs/jbd2/journal.c > +++ b/fs/jbd2/journal.c > @@ -1515,9 +1515,8 @@ journal_t *jbd2_journal_init_inode(struct inode *inode) > > journal->j_inode = inode; > snprintf(journal->j_devname, sizeof(journal->j_devname), > - "%pg", journal->j_dev); > - p = strreplace(journal->j_devname, '/', '!'); > - sprintf(p, "-%lu", journal->j_inode->i_ino); > + "%pg-%lu", journal->j_dev, journal->j_inode->i_ino); > + strreplace(journal->j_devname, '/', '!'); > jbd2_stats_proc_init(journal); > > return journal; > -- > 2.40.0.1.gaa8946217a0b > -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR
