* [PATCH] md: Remove risk of overflow via sprintf) by using snprintf() in md_check_recovery()
@ 2011-02-11 21:30 Jesper Juhl
2011-02-12 9:34 ` Daniel K.
0 siblings, 1 reply; 6+ messages in thread
From: Jesper Juhl @ 2011-02-11 21:30 UTC (permalink / raw
To: linux-kernel; +Cc: linux-raid, Neil Brown, Neil Brown
sprintf() is dangerous - given the wrong source string it will overflow
the destination. snprintf() is safer in that at least we'll never overflow
the destination. Even if overflow will never happen today, code changes
over time and snprintf() is just safer in the long run.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
---
md.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
just compile tested
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 0cc30ec..6283658 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7164,7 +7164,7 @@ void md_check_recovery(mddev_t *mddev)
if (mddev->pers->hot_remove_disk(
mddev, rdev->raid_disk)==0) {
char nm[20];
- sprintf(nm,"rd%d", rdev->raid_disk);
+ snprintf(nm, sizeof(nm), "rd%d", rdev->raid_disk);
sysfs_remove_link(&mddev->kobj, nm);
rdev->raid_disk = -1;
}
--
Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/
Plain text mails only, please.
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] md: Remove risk of overflow via sprintf) by using snprintf() in md_check_recovery()
2011-02-11 21:30 Jesper Juhl
@ 2011-02-12 9:34 ` Daniel K.
2011-02-12 13:48 ` Michael Tokarev
0 siblings, 1 reply; 6+ messages in thread
From: Daniel K. @ 2011-02-12 9:34 UTC (permalink / raw
To: Jesper Juhl; +Cc: linux-kernel, linux-raid, Neil Brown, Neil Brown
Jesper Juhl wrote:
> sprintf() is dangerous - given the wrong source string it will overflow
> the destination. snprintf() is safer in that at least we'll never overflow
> the destination. Even if overflow will never happen today, code changes
> over time and snprintf() is just safer in the long run.
> - sprintf(nm,"rd%d", rdev->raid_disk);
> + snprintf(nm, sizeof(nm), "rd%d", rdev->raid_disk);
> sysfs_remove_link(&mddev->kobj, nm);
What if "rd1234" get truncated to "rd123" and you remove the wrong link.
(No, I didn't actually bother to check how much room was allocated.)
Isn't it better to overflow than silently to unlink the wrong file?
What will happen when you try to unlink the "rd123" file again, when the
actual 123 is meant?
Whatever the real fix is, should this be checked for at create_link time
as well?
Daniel K.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] md: Remove risk of overflow via sprintf) by using snprintf() in md_check_recovery()
2011-02-12 9:34 ` Daniel K.
@ 2011-02-12 13:48 ` Michael Tokarev
2011-02-12 14:06 ` Daniel K.
0 siblings, 1 reply; 6+ messages in thread
From: Michael Tokarev @ 2011-02-12 13:48 UTC (permalink / raw
To: Daniel K.; +Cc: Jesper Juhl, linux-kernel, linux-raid, Neil Brown, Neil Brown
12.02.2011 12:34, Daniel K. wrote:
> Jesper Juhl wrote:
>> sprintf() is dangerous - given the wrong source string it will
>> overflow the destination. snprintf() is safer in that at least we'll
>> never overflow the destination. Even if overflow will never happen
>> today, code changes over time and snprintf() is just safer in the long
>> run.
>
>> - sprintf(nm,"rd%d", rdev->raid_disk);
>> + snprintf(nm, sizeof(nm), "rd%d",
>> rdev->raid_disk);
>> sysfs_remove_link(&mddev->kobj, nm);
>
> What if "rd1234" get truncated to "rd123" and you remove the wrong link.
> (No, I didn't actually bother to check how much room was allocated.)
That allocation is in the line above first sprintf which you deleted.
Sure, didn't bother, it's very difficult.
C'mon guys, this is pointless. 20 bytes allocated for the device
name, and this is for raid disk number. It is impossible to have
more than 10^17 (20 bytes total, 2 for "rd" and on for the zero
terminator) drives in a single array.
/mjt
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] md: Remove risk of overflow via sprintf) by using snprintf() in md_check_recovery()
2011-02-12 13:48 ` Michael Tokarev
@ 2011-02-12 14:06 ` Daniel K.
2011-02-13 20:18 ` Jesper Juhl
0 siblings, 1 reply; 6+ messages in thread
From: Daniel K. @ 2011-02-12 14:06 UTC (permalink / raw
To: Michael Tokarev
Cc: Daniel K., Jesper Juhl, linux-kernel, linux-raid, Neil Brown,
Neil Brown
Michael Tokarev wrote:
> 12.02.2011 12:34, Daniel K. wrote:
>> Jesper Juhl wrote:
>>> sprintf() is dangerous - given the wrong source string it will
>>> overflow the destination. snprintf() is safer in that at least we'll
>>> never overflow the destination. Even if overflow will never happen
>>> today, code changes over time and snprintf() is just safer in the long
>>> run.
>>> - sprintf(nm,"rd%d", rdev->raid_disk);
>>> + snprintf(nm, sizeof(nm), "rd%d", rdev->raid_disk);
>>> sysfs_remove_link(&mddev->kobj, nm);
>> What if "rd1234" get truncated to "rd123" and you remove the wrong link.
>> (No, I didn't actually bother to check how much room was allocated.)
>
> That allocation is in the line above first sprintf which you deleted.
> Sure, didn't bother, it's very difficult.
Yeah, early morning, I cut to much, and I didn't bother to look it up
again, sorry for being lazy. Nevertheless, the actual size is of the
allocation is of no particular importance. As you've shown, the current
allocation of 20 bytes is more than enough.
> C'mon guys, this is pointless. 20 bytes allocated for the device
> name, and this is for raid disk number. It is impossible to have
> more than 10^17 (20 bytes total, 2 for "rd" and on for the zero
> terminator) drives in a single array.
Agreed, and this was sort of the point.
In all probability it would not overflow, and if it did, it would be
better for it to crash and burn, than to unlink the wrong files.
Daniel K.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] md: Remove risk of overflow via sprintf) by using snprintf() in md_check_recovery()
2011-02-12 14:06 ` Daniel K.
@ 2011-02-13 20:18 ` Jesper Juhl
0 siblings, 0 replies; 6+ messages in thread
From: Jesper Juhl @ 2011-02-13 20:18 UTC (permalink / raw
To: Daniel K.
Cc: Michael Tokarev, linux-kernel, linux-raid, Neil Brown, Neil Brown
On Sat, 12 Feb 2011, Daniel K. wrote:
> Michael Tokarev wrote:
> > 12.02.2011 12:34, Daniel K. wrote:
> > > Jesper Juhl wrote:
> > > > sprintf() is dangerous - given the wrong source string it will
> > > > overflow the destination. snprintf() is safer in that at least we'll
> > > > never overflow the destination. Even if overflow will never happen
> > > > today, code changes over time and snprintf() is just safer in the long
> > > > run.
> > > > - sprintf(nm,"rd%d", rdev->raid_disk);
> > > > + snprintf(nm, sizeof(nm), "rd%d",
> > > > rdev->raid_disk);
> > > > sysfs_remove_link(&mddev->kobj, nm);
> > > What if "rd1234" get truncated to "rd123" and you remove the wrong link.
> > > (No, I didn't actually bother to check how much room was allocated.)
> >
> > That allocation is in the line above first sprintf which you deleted.
> > Sure, didn't bother, it's very difficult.
>
> Yeah, early morning, I cut to much, and I didn't bother to look it up again,
> sorry for being lazy. Nevertheless, the actual size is of the allocation is of
> no particular importance. As you've shown, the current allocation of 20 bytes
> is more than enough.
>
> > C'mon guys, this is pointless. 20 bytes allocated for the device
> > name, and this is for raid disk number. It is impossible to have
> > more than 10^17 (20 bytes total, 2 for "rd" and on for the zero
> > terminator) drives in a single array.
>
> Agreed, and this was sort of the point.
>
> In all probability it would not overflow, and if it did, it would be better
> for it to crash and burn, than to unlink the wrong files.
>
Point taken. Ignore the patch.
--
Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/
Plain text mails only, please.
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] md: Remove risk of overflow via sprintf) by using snprintf() in md_check_recovery()
[not found] ` <glo1k-1AX-17@gated-at.bofh.it>
@ 2011-02-13 20:53 ` Bodo Eggert
0 siblings, 0 replies; 6+ messages in thread
From: Bodo Eggert @ 2011-02-13 20:53 UTC (permalink / raw
To: Michael Tokarev, Daniel K., Jesper Juhl, linux-kernel, linux-raid,
Neil Brown, Neil Brown
Michael Tokarev <mjt@tls.msk.ru> wrote:
> 12.02.2011 12:34, Daniel K. wrote:
>> Jesper Juhl wrote:
>>> sprintf() is dangerous - given the wrong source string it will
>>> overflow the destination. snprintf() is safer in that at least we'll
>>> never overflow the destination. Even if overflow will never happen
>>> today, code changes over time and snprintf() is just safer in the long
>>> run.
>>
>>> - sprintf(nm,"rd%d", rdev->raid_disk);
>>> + snprintf(nm, sizeof(nm), "rd%d",
>>> rdev->raid_disk);
>>> sysfs_remove_link(&mddev->kobj, nm);
> C'mon guys, this is pointless. 20 bytes allocated for the device
> name, and this is for raid disk number. It is impossible to have
> more than 10^17 (20 bytes total, 2 for "rd" and on for the zero
> terminator) drives in a single array.
If you argue that you might get a buffer overflow, you'll have to check
for snprintf errors, too.
--
Logic: The art of being wrong with confidence...
Friß, Spammer: tR@c.7eggert.dyndns.org S5xk@h.7eggert.dyndns.org
loqnjg@GFhzy.7eggert.dyndns.org 6hs4Axaqf@ndlJ.7eggert.dyndns.org
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-02-13 20:53 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <gl8SB-1hb-11@gated-at.bofh.it>
[not found] ` <glk7o-3l2-17@gated-at.bofh.it>
[not found] ` <glo1k-1AX-17@gated-at.bofh.it>
2011-02-13 20:53 ` [PATCH] md: Remove risk of overflow via sprintf) by using snprintf() in md_check_recovery() Bodo Eggert
2011-02-11 21:30 Jesper Juhl
2011-02-12 9:34 ` Daniel K.
2011-02-12 13:48 ` Michael Tokarev
2011-02-12 14:06 ` Daniel K.
2011-02-13 20:18 ` Jesper Juhl
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).