This is a note to let you know that I've just added the patch titled
xfs: Use scnprintf() for avoiding potential buffer overflow
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xfs-use-scnprintf-for-avoiding-potential-buffer-overflow.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Wed Oct 26 04:49:40 PM CEST 2022
From: Chandan Babu R <chandan.babu@xxxxxxxxxx>
Date: Wed, 26 Oct 2022 11:58:26 +0530
Subject: xfs: Use scnprintf() for avoiding potential buffer overflow
To: gregkh@xxxxxxxxxxxxxxxxxxx
Cc: sashal@xxxxxxxxxx, mcgrof@xxxxxxxxxx, linux-xfs@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, djwong@xxxxxxxxxx, chandan.babu@xxxxxxxxxx, amir73il@xxxxxxxxx, leah.rumancik@xxxxxxxxx
Message-ID: <20221026062843.927600-10-chandan.babu@xxxxxxxxxx>
From: Takashi Iwai <tiwai@xxxxxxx>
commit 17bb60b74124e9491d593e2601e3afe14daa2f57 upstream.
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit. Fix it by replacing with scnprintf().
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Reviewed-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
Acked-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Chandan Babu R <chandan.babu@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/xfs/xfs_stats.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/fs/xfs/xfs_stats.c
+++ b/fs/xfs/xfs_stats.c
@@ -57,13 +57,13 @@ int xfs_stats_format(struct xfsstats __p
/* Loop over all stats groups */
for (i = j = 0; i < ARRAY_SIZE(xstats); i++) {
- len += snprintf(buf + len, PATH_MAX - len, "%s",
+ len += scnprintf(buf + len, PATH_MAX - len, "%s",
xstats[i].desc);
/* inner loop does each group */
for (; j < xstats[i].endpoint; j++)
- len += snprintf(buf + len, PATH_MAX - len, " %u",
+ len += scnprintf(buf + len, PATH_MAX - len, " %u",
counter_val(stats, j));
- len += snprintf(buf + len, PATH_MAX - len, "\n");
+ len += scnprintf(buf + len, PATH_MAX - len, "\n");
}
/* extra precision counters */
for_each_possible_cpu(i) {
@@ -72,9 +72,9 @@ int xfs_stats_format(struct xfsstats __p
xs_read_bytes += per_cpu_ptr(stats, i)->s.xs_read_bytes;
}
- len += snprintf(buf + len, PATH_MAX-len, "xpc %Lu %Lu %Lu\n",
+ len += scnprintf(buf + len, PATH_MAX-len, "xpc %Lu %Lu %Lu\n",
xs_xstrat_bytes, xs_write_bytes, xs_read_bytes);
- len += snprintf(buf + len, PATH_MAX-len, "debug %u\n",
+ len += scnprintf(buf + len, PATH_MAX-len, "debug %u\n",
#if defined(DEBUG)
1);
#else
Patches currently in stable-queue which might be from chandan.babu@xxxxxxxxxx are
queue-5.4/xfs-check-owner-of-dir3-blocks.patch
queue-5.4/xfs-throttle-commits-on-delayed-background-cil-push.patch
queue-5.4/xfs-factor-common-ail-item-deletion-code.patch
queue-5.4/xfs-remove-the-xfs_dq_logitem_t-typedef.patch
queue-5.4/xfs-fix-buffer-corruption-reporting-when-xfs_dir3_free_header_check-fails.patch
queue-5.4/xfs-xfs_buf_corruption_error-should-take-__this_address.patch
queue-5.4/xfs-open-code-insert-range-extent-split-helper.patch
queue-5.4/xfs-don-t-write-a-corrupt-unmount-record-to-force-summary-counter-recalc.patch
queue-5.4/xfs-check-owner-of-dir3-data-blocks.patch
queue-5.4/xfs-factor-out-quotaoff-intent-ail-removal-and-memory-free.patch
queue-5.4/xfs-trylock-underlying-buffer-on-dquot-flush.patch
queue-5.4/xfs-remove-the-xfs_disk_dquot_t-and-xfs_dquot_t.patch
queue-5.4/xfs-add-a-function-to-deal-with-corrupt-buffers-post-verifiers.patch
queue-5.4/xfs-fix-use-after-free-on-cil-context-on-shutdown.patch
queue-5.4/xfs-tail-updates-only-need-to-occur-when-lsn-changes.patch
queue-5.4/xfs-use-scnprintf-for-avoiding-potential-buffer-overflow.patch
queue-5.4/xfs-move-inode-flush-to-the-sync-workqueue.patch
queue-5.4/xfs-lower-cil-flush-limit-for-large-logs.patch
queue-5.4/xfs-rework-collapse-range-into-an-atomic-operation.patch
queue-5.4/xfs-remove-the-xfs_qoff_logitem_t-typedef.patch
queue-5.4/xfs-fix-unmount-hang-and-memory-leak-on-shutdown-during-quotaoff.patch
queue-5.4/xfs-preserve-default-grace-interval-during-quotacheck.patch
queue-5.4/xfs-replace-function-declaration-by-actual-definition.patch
queue-5.4/xfs-rework-insert-range-into-an-atomic-operation.patch
queue-5.4/xfs-factor-out-a-new-xfs_log_force_inode-helper.patch
queue-5.4/xfs-reflink-should-force-the-log-out-if-mounted-with-wsync.patch
