From patchwork Mon Jan 26 16:48:16 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Ryabinin X-Patchwork-Id: 432935 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3145F1401DC for ; Tue, 27 Jan 2015 03:48:47 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756251AbbAZQsa (ORCPT ); Mon, 26 Jan 2015 11:48:30 -0500 Received: from mailout2.w1.samsung.com ([210.118.77.12]:11381 "EHLO mailout2.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756208AbbAZQs0 (ORCPT ); Mon, 26 Jan 2015 11:48:26 -0500 Received: from eucpsbgm1.samsung.com (unknown [203.254.199.244]) by mailout2.w1.samsung.com (Oracle Communications Messaging Server 7u4-24.01(7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTP id <0NIS005K3MVFD9C0@mailout2.w1.samsung.com>; Mon, 26 Jan 2015 16:52:27 +0000 (GMT) X-AuditID: cbfec7f4-b7f126d000001e9a-d3-54c66f469713 Received: from eusync2.samsung.com ( [203.254.199.212]) by eucpsbgm1.samsung.com (EUCPMTA) with SMTP id 57.01.07834.64F66C45; Mon, 26 Jan 2015 16:45:58 +0000 (GMT) Received: from localhost.localdomain ([106.109.129.143]) by eusync2.samsung.com (Oracle Communications Messaging Server 7u4-23.01 (7.0.4.23.0) 64bit (built Aug 10 2011)) with ESMTPA id <0NIS000ZCMOK8Z50@eusync2.samsung.com>; Mon, 26 Jan 2015 16:48:23 +0000 (GMT) From: Andrey Ryabinin To: linux-kernel@vger.kernel.org Cc: "Aneesh Kumar K.V" , Eric Van Hensbergen , Ron Minnich , Latchesar Ionkov , "David S. Miller" , v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org, Andrey Ryabinin Subject: [PATCH] net/9p: fix format string in p9_mount_tag_show() Date: Mon, 26 Jan 2015 19:48:16 +0300 Message-id: <1422290896-25042-1-git-send-email-a.ryabinin@samsung.com> X-Mailer: git-send-email 2.2.2 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrGJMWRmVeSWpSXmKPExsVy+t/xK7pu+cdCDHqWmlts+/WIzeLx63ks FnPOt7BYzJ21id3i8q45bBb3pt9mtTi2QMxi2++NzBYf/65ic+D02LLyJpPHzll32T2m3dvE 5PHg0GYWj90LPjN59G1ZxejRu3Uhm8fnTXIBHFFcNimpOZllqUX6dglcGXubr7IUzGKvmNN+ g7mBsZGti5GTQ0LARGLKjd8sELaYxIV764HiXBxCAksZJSYc/8YM4fQxSRw5voMVpIpNQE/i 36ztYN0iAgoSm3ufsYIUMQscZJLYt/UKO0hCWMBR4vyVvUwgNouAqkTT/bdgcV4BN4mv8z8A NXAArZOTuPAxfgIj9wJGhlWMoqmlyQXFSem5hnrFibnFpXnpesn5uZsYIWH1ZQfj4mNWhxgF OBiVeHgnTDwaIsSaWFZcmXuIUYKDWUmEVzr3WIgQb0piZVVqUX58UWlOavEhRiYOTqkGxpo4 Dbu9fk8qQrZHvgmzWShgu86pLsXP9lWnbr6AguuU/B9/kiTT1s9bvy2KMdeeazPPY5NDFvwL /y25tId7m88cmd2rDfPPO66I8zcTbUm/cOr6ouMJq9/uOum25MutK4/mPrzA0smyRHLGg4vh bDF2+xiEnPJDGhTeyVp/ajc4c7eKddUpfSWW4oxEQy3mouJEAL1EVY8JAgAA Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Using "%s" for non-NULL terminated string is quite dangerous, since this causes reading out of bounds. chan->tag is non-NULL terminated, so precision must be specified for printing it. Fixes: 86c8437383ac ("net/9p: Add sysfs mount_tag file for virtio 9P device") Signed-off-by: Andrey Ryabinin --- net/9p/trans_virtio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c index daa749c..f0d5f90 100644 --- a/net/9p/trans_virtio.c +++ b/net/9p/trans_virtio.c @@ -504,7 +504,8 @@ static ssize_t p9_mount_tag_show(struct device *dev, vdev = dev_to_virtio(dev); chan = vdev->priv; - return snprintf(buf, chan->tag_len + 1, "%s", chan->tag); + return snprintf(buf, chan->tag_len + 1, "%.*s", + chan->tag_len, chan->tag); } static DEVICE_ATTR(mount_tag, 0444, p9_mount_tag_show, NULL);