The iSCSI CHAP authentication username and password are stored into a buffer that's smaller than a page, so use strlcpy() to copy the incoming string, and add strim() to strip any trailing newline. Return -EINVAL if the incoming string wouldn't fit in the buffer. Signed-off-by: Eric Seppanen <eric@xxxxxxxxxxxxxxx> --- drivers/target/iscsi/iscsi_target_configfs.c | 31 ++++++++++++++------------ 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c index 8d8b3ff..23d02ce 100644 --- a/drivers/target/iscsi/iscsi_target_configfs.c +++ b/drivers/target/iscsi/iscsi_target_configfs.c @@ -452,7 +452,7 @@ static struct configfs_attribute *lio_target_nacl_attrib_attrs[] = { /* Start items for lio_target_nacl_auth_cit */ -#define __DEF_NACL_AUTH_STR(prefix, name, flags) \ +#define __DEF_NACL_AUTH_STR(prefix, name, maxlen, flags) \ static ssize_t __iscsi_##prefix##_show_##name( \ struct iscsi_node_acl *nacl, \ char *page) \ @@ -474,7 +474,10 @@ static ssize_t __iscsi_##prefix##_store_##name( \ if (!capable(CAP_SYS_ADMIN)) \ return -EPERM; \ \ - snprintf(auth->name, PAGE_SIZE, "%s", page); \ + if (count >= maxlen) \ + return -EINVAL; \ + strlcpy(auth->name, page, maxlen); \ + strim(auth->name); \ if (!strncmp("NULL", auth->name, 4)) \ auth->naf_flags &= ~flags; \ else \ @@ -502,8 +505,8 @@ static ssize_t __iscsi_##prefix##_show_##name( \ return snprintf(page, PAGE_SIZE, "%d\n", auth->name); \ } -#define DEF_NACL_AUTH_STR(name, flags) \ - __DEF_NACL_AUTH_STR(nacl_auth, name, flags) \ +#define DEF_NACL_AUTH_STR(name, maxlen, flags) \ + __DEF_NACL_AUTH_STR(nacl_auth, name, maxlen, flags) \ static ssize_t iscsi_nacl_auth_show_##name( \ struct se_node_acl *nacl, \ char *page) \ @@ -536,12 +539,12 @@ static ssize_t iscsi_nacl_auth_show_##name( \ /* * One-way authentication userid */ -DEF_NACL_AUTH_STR(userid, NAF_USERID_SET); +DEF_NACL_AUTH_STR(userid, MAX_USER_LEN, NAF_USERID_SET); AUTH_ATTR(userid, S_IRUGO | S_IWUSR); /* * One-way authentication password */ -DEF_NACL_AUTH_STR(password, NAF_PASSWORD_SET); +DEF_NACL_AUTH_STR(password, MAX_PASS_LEN, NAF_PASSWORD_SET); AUTH_ATTR(password, S_IRUGO | S_IWUSR); /* * Enforce mutual authentication @@ -551,12 +554,12 @@ AUTH_ATTR_RO(authenticate_target); /* * Mutual authentication userid */ -DEF_NACL_AUTH_STR(userid_mutual, NAF_USERID_IN_SET); +DEF_NACL_AUTH_STR(userid_mutual, MAX_USER_LEN, NAF_USERID_IN_SET); AUTH_ATTR(userid_mutual, S_IRUGO | S_IWUSR); /* * Mutual authentication password */ -DEF_NACL_AUTH_STR(password_mutual, NAF_PASSWORD_IN_SET); +DEF_NACL_AUTH_STR(password_mutual, MAX_PASS_LEN, NAF_PASSWORD_IN_SET); AUTH_ATTR(password_mutual, S_IRUGO | S_IWUSR); static struct configfs_attribute *lio_target_nacl_auth_attrs[] = { @@ -1430,8 +1433,8 @@ static void lio_target_call_coredeltiqn( /* Start lio_target_discovery_auth_cit */ -#define DEF_DISC_AUTH_STR(name, flags) \ - __DEF_NACL_AUTH_STR(disc, name, flags) \ +#define DEF_DISC_AUTH_STR(name, maxlen, flags) \ + __DEF_NACL_AUTH_STR(disc, name, maxlen, flags) \ static ssize_t iscsi_disc_show_##name( \ struct target_fabric_configfs *tf, \ char *page) \ @@ -1464,12 +1467,12 @@ static ssize_t iscsi_disc_show_##name( \ /* * One-way authentication userid */ -DEF_DISC_AUTH_STR(userid, NAF_USERID_SET); +DEF_DISC_AUTH_STR(userid, MAX_USER_LEN, NAF_USERID_SET); DISC_AUTH_ATTR(userid, S_IRUGO | S_IWUSR); /* * One-way authentication password */ -DEF_DISC_AUTH_STR(password, NAF_PASSWORD_SET); +DEF_DISC_AUTH_STR(password, MAX_PASS_LEN, NAF_PASSWORD_SET); DISC_AUTH_ATTR(password, S_IRUGO | S_IWUSR); /* * Enforce mutual authentication @@ -1479,12 +1482,12 @@ DISC_AUTH_ATTR_RO(authenticate_target); /* * Mutual authentication userid */ -DEF_DISC_AUTH_STR(userid_mutual, NAF_USERID_IN_SET); +DEF_DISC_AUTH_STR(userid_mutual, MAX_USER_LEN, NAF_USERID_IN_SET); DISC_AUTH_ATTR(userid_mutual, S_IRUGO | S_IWUSR); /* * Mutual authentication password */ -DEF_DISC_AUTH_STR(password_mutual, NAF_PASSWORD_IN_SET); +DEF_DISC_AUTH_STR(password_mutual, MAX_PASS_LEN, NAF_PASSWORD_IN_SET); DISC_AUTH_ATTR(password_mutual, S_IRUGO | S_IWUSR); /* -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe target-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html