On Tue, Feb 20, 2018 at 02:09:11PM +0100, Arnd Bergmann wrote:
> gcc warns about a possible overflow of the kmem_cache string, when adding
> four characters to a string of the same length:
>
> drivers/md/raid5.c: In function 'setup_conf':
> drivers/md/raid5.c:2207:34: error: '-alt' directive writing 4 bytes into a region of size between 1 and 32 [-Werror=format-overflow=]
> sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
> ^~~~
> drivers/md/raid5.c:2207:2: note: 'sprintf' output between 5 and 36 bytes into a destination of size 32
> sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> If I'm counting correctly, we need 11 characters for the fixed part
> of the string and 18 characters for a 64-bit pointer (when no gendisk
> is used), so that leaves three characters for conf->level, which should
> always be sufficient.
>
> This makes the code use snprintf() with the correct length, to
> make the code more robust against changes, and to get the compiler
> to shut up.
>
> In commit f4be6b43f1ac ("md/raid5: ensure we create a unique name for
> kmem_cache when mddev has no gendisk") from 2010, Neil said that
> the pointer could be removed "shortly" once devices without gendisk
> are disallowed. I have no idea if that happened, but if it did, that
> should probably be changed as well.
>
> Signed-off-by: Arnd Bergmann <arnd@xxxxxxxx>
Applied, thanks!
> ---
> drivers/md/raid5.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
> index 50d01144b805..7ef368061424 100644
> --- a/drivers/md/raid5.c
> +++ b/drivers/md/raid5.c
> @@ -2196,15 +2196,16 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp)
> static int grow_stripes(struct r5conf *conf, int num)
> {
> struct kmem_cache *sc;
> + size_t namelen = sizeof(conf->cache_name[0]);
> int devs = max(conf->raid_disks, conf->previous_raid_disks);
>
> if (conf->mddev->gendisk)
> - sprintf(conf->cache_name[0],
> + snprintf(conf->cache_name[0], namelen,
> "raid%d-%s", conf->level, mdname(conf->mddev));
> else
> - sprintf(conf->cache_name[0],
> + snprintf(conf->cache_name[0], namelen,
> "raid%d-%p", conf->level, conf->mddev);
> - sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
> + snprintf(conf->cache_name[1], namelen, "%.27s-alt", conf->cache_name[0]);
>
> conf->active_name = 0;
> sc = kmem_cache_create(conf->cache_name[conf->active_name],
> --
> 2.9.0
>
--
To unsubscribe from this list: send the line "unsubscribe linux-raid" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
