This is a note to let you know that I've just added the patch titled
gfs2: Switch from strlcpy to strscpy
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
gfs2-switch-from-strlcpy-to-strscpy.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 204c0300c4e99707e9fb6e57840aa1127060e63f Mon Sep 17 00:00:00 2001
From: Andreas Gruenbacher <agruenba@xxxxxxxxxx>
Date: Fri, 26 Aug 2022 15:12:17 +0200
Subject: gfs2: Switch from strlcpy to strscpy
From: Andreas Gruenbacher <agruenba@xxxxxxxxxx>
commit 204c0300c4e99707e9fb6e57840aa1127060e63f upstream.
Switch from strlcpy to strscpy and make sure that @count is the size of
the smaller of the source and destination buffers. This prevents
reading beyond the end of the source buffer when the source string isn't
null terminated.
Found by a modified version of syzkaller.
Suggested-by: Wolfram Sang <wsa+renesas@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Andreas Gruenbacher <agruenba@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/gfs2/ops_fstype.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -391,8 +391,10 @@ static int init_names(struct gfs2_sbd *s
if (!table[0])
table = sdp->sd_vfs->s_id;
- strlcpy(sdp->sd_proto_name, proto, GFS2_FSNAME_LEN);
- strlcpy(sdp->sd_table_name, table, GFS2_FSNAME_LEN);
+ BUILD_BUG_ON(GFS2_LOCKNAME_LEN > GFS2_FSNAME_LEN);
+
+ strscpy(sdp->sd_proto_name, proto, GFS2_LOCKNAME_LEN);
+ strscpy(sdp->sd_table_name, table, GFS2_LOCKNAME_LEN);
table = sdp->sd_table_name;
while ((table = strchr(table, '/')))
Patches currently in stable-queue which might be from agruenba@xxxxxxxxxx are
queue-4.14/gfs2-check-sb_bsize_shift-after-reading-superblock.patch
queue-4.14/gfs2-switch-from-strlcpy-to-strscpy.patch
