On Mon, May 11, 2020 at 5:01 PM Stephen Smalley
<stephen.smalley.work@xxxxxxxxx> wrote:
> As per the man page, quotactl(2) expects to be passed a pointer to
> a 4-byte buffer for Q_GETFMT. The kernel copies a single u32 value.
> On Ubuntu, this was detected as a stack smash when running the test.
> Fix the test program.
>
> Signed-off-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx>
Acked-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
> ---
> v2 includes stdint.h and uses uint32_t for the fmtval variable.
>
> tests/filesystem/quotas_test.c | 11 ++++++-----
> 1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/tests/filesystem/quotas_test.c b/tests/filesystem/quotas_test.c
> index 8359811..bca230d 100644
> --- a/tests/filesystem/quotas_test.c
> +++ b/tests/filesystem/quotas_test.c
> @@ -1,3 +1,4 @@
> +#include <stdint.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
> @@ -33,7 +34,7 @@ int main(int argc, char *argv[])
> int opt, result, qcmd, save_err, test_id = geteuid();
> char *context, *src = NULL, *tgt = NULL;
> bool verbose = false;
> - char fmt_buf[2];
> + uint32_t fmtval;
>
> while ((opt = getopt(argc, argv, "s:t:v")) != -1) {
> switch (opt) {
> @@ -77,7 +78,7 @@ int main(int argc, char *argv[])
> printf("User Quota - ON\n");
>
> qcmd = QCMD(Q_GETFMT, USRQUOTA);
> - result = quotactl(qcmd, src, test_id, fmt_buf);
> + result = quotactl(qcmd, src, test_id, (caddr_t)&fmtval);
> save_err = errno;
> if (result < 0) {
> fprintf(stderr, "quotactl(Q_GETFMT, USRQUOTA) Failed: %s\n",
> @@ -85,7 +86,7 @@ int main(int argc, char *argv[])
> return save_err;
> }
> if (verbose)
> - printf("User Format: 0x%x\n", fmt_buf[0]);
> + printf("User Format: 0x%x\n", fmtval);
>
> qcmd = QCMD(Q_QUOTAOFF, USRQUOTA);
> result = quotactl(qcmd, src, QFMT_VFS_V0, tgt);
> @@ -113,7 +114,7 @@ int main(int argc, char *argv[])
> printf("Group Quota - ON\n");
>
> qcmd = QCMD(Q_GETFMT, GRPQUOTA);
> - result = quotactl(qcmd, src, test_id, fmt_buf);
> + result = quotactl(qcmd, src, test_id, (caddr_t)&fmtval);
> save_err = errno;
> if (result < 0) {
> fprintf(stderr, "quotactl(Q_GETFMT, GRPQUOTA) Failed: %s\n",
> @@ -121,7 +122,7 @@ int main(int argc, char *argv[])
> return save_err;
> }
> if (verbose)
> - printf("Group Format: 0x%x\n", fmt_buf[0]);
> + printf("Group Format: 0x%x\n", fmtval);
>
> qcmd = QCMD(Q_QUOTAOFF, GRPQUOTA);
> result = quotactl(qcmd, src, QFMT_VFS_V0, tgt);
> --
> 2.23.3
>
--
Ondrej Mosnacek <omosnace at redhat dot com>
Software Engineer, Security Technologies
Red Hat, Inc.
