On Wed, Oct 18, 2017 at 01:59:13AM +0200, David Disseldorp wrote:
> A sufficiently long Unit Serial string, dbroot path, and/or ALUA target
> portal group name may result in truncation of the ALUA state file path
> prior to usage. Fix this by using kasprintf() instead.
>
> Fixes: fdddf932269a ("target: use new "dbroot" target attribute")
> Signed-off-by: David Disseldorp <ddiss@xxxxxxx>
> ---
> drivers/target/target_core_alua.c | 49 ++++++++++++++++++++++-----------------
> drivers/target/target_core_alua.h | 9 -------
> 2 files changed, 28 insertions(+), 30 deletions(-)
>
> diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
> index 928127642574..fddb2066710a 100644
> --- a/drivers/target/target_core_alua.c
> +++ b/drivers/target/target_core_alua.c
> @@ -918,7 +918,7 @@ static int core_alua_update_tpg_primary_metadata(
> {
> unsigned char *md_buf;
> struct t10_wwn *wwn = &tg_pt_gp->tg_pt_gp_dev->t10_wwn;
> - char path[ALUA_METADATA_PATH_LEN];
> + char *path;
> int len, rc;
>
> md_buf = kzalloc(ALUA_MD_BUF_LEN, GFP_KERNEL);
> @@ -927,8 +927,6 @@ static int core_alua_update_tpg_primary_metadata(
> return -ENOMEM;
> }
>
> - memset(path, 0, ALUA_METADATA_PATH_LEN);
> -
> len = snprintf(md_buf, ALUA_MD_BUF_LEN,
> "tg_pt_gp_id=%hu\n"
> "alua_access_state=0x%02x\n"
> @@ -937,11 +935,16 @@ static int core_alua_update_tpg_primary_metadata(
> tg_pt_gp->tg_pt_gp_alua_access_state,
> tg_pt_gp->tg_pt_gp_alua_access_status);
>
> - snprintf(path, ALUA_METADATA_PATH_LEN,
> - "%s/alua/tpgs_%s/%s", db_root, &wwn->unit_serial[0],
> - config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item));
> + path = kasprintf(GFP_KERNEL, "%s/alua/tpgs_%s/%s", db_root,
> + &wwn->unit_serial[0],
> + config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item));
> + if (!path) {
> + kfree(md_buf);
> + return -ENOMEM;
> + }
>
> rc = core_alua_write_tpg_metadata(path, md_buf, len);
> + kfree(path);
> kfree(md_buf);
> return rc;
Maybe write this as:
rc = -ENOMEM
path = kasprintf(...);
if (path) {
rc = core_alua_write_tpg_metadata(path, md_buf, len);
kfree(path);
}
kfree(md_buf);
return rc;
Otherwise looks good:
Reviewed-by: Christoph Hellwig <hch@xxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
