Commit 5a3b590d authored by Theodore Ts'o's avatar Theodore Ts'o

ext4: don't leak old mountpoint samples

When the first file is opened, ext4 samples the mountpoint of the
filesystem in 64 bytes of the super block.  It does so using
strlcpy(), this means that the remaining bytes in the super block
string buffer are untouched.  If the mount point before had a longer
path than the current one, it can be reconstructed.

Consider the case where the fs was mounted to "/media/johnjdeveloper"
and later to "/".  The super block buffer then contains
"/\x00edia/johnjdeveloper".

This case was seen in the wild and caused confusion how the name
of a developer ands up on the super block of a filesystem used
in production...

Fix this by using strncpy() instead of strlcpy().  The superblock
field is defined to be a fixed-size char array, and it is already
marked using __nonstring in fs/ext4/ext4.h.  The consumer of the field
in e2fsprogs already assumes that in the case of a 64+ byte mount
path, that s_last_mounted will not be NUL terminated.

Link: https://lore.kernel.org/r/X9ujIOJG/HqMr88R@mit.eduReported-by: default avatarRichard Weinberger <richard@nod.at>
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
parent a3f5cf14
...@@ -810,7 +810,7 @@ static int ext4_sample_last_mounted(struct super_block *sb, ...@@ -810,7 +810,7 @@ static int ext4_sample_last_mounted(struct super_block *sb,
if (err) if (err)
goto out_journal; goto out_journal;
lock_buffer(sbi->s_sbh); lock_buffer(sbi->s_sbh);
strlcpy(sbi->s_es->s_last_mounted, cp, strncpy(sbi->s_es->s_last_mounted, cp,
sizeof(sbi->s_es->s_last_mounted)); sizeof(sbi->s_es->s_last_mounted));
ext4_superblock_csum_set(sb); ext4_superblock_csum_set(sb);
unlock_buffer(sbi->s_sbh); unlock_buffer(sbi->s_sbh);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment