diff options
| author | Zichen Xie <zichenxie0106@gmail.com> | 2024-12-18 00:13:12 +0800 |
|---|---|---|
| committer | Anna Schumaker <anna.schumaker@oracle.com> | 2025-01-13 13:27:25 -0500 |
| commit | 49fd4e34751e90e6df009b70cd0659dc839e7ca8 (patch) | |
| tree | c4424b3045aecc4bc5ba27d0a6a6ed75c1d6f323 | |
| parent | bb504321b96550f9a351920e169de141a3f4c6a1 (diff) | |
NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
name is char[64] where the size of clnt->cl_program->name remains
unknown. Invoking strcat() directly will also lead to potential buffer
overflow. Change them to strscpy() and strncat() to fix potential
issues.
Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
| -rw-r--r-- | fs/nfs/sysfs.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c index bf378ecd5d9f..7b59a40d40c0 100644 --- a/fs/nfs/sysfs.c +++ b/fs/nfs/sysfs.c @@ -280,9 +280,9 @@ void nfs_sysfs_link_rpc_client(struct nfs_server *server, char name[RPC_CLIENT_NAME_SIZE]; int ret; - strcpy(name, clnt->cl_program->name); - strcat(name, uniq ? uniq : ""); - strcat(name, "_client"); + strscpy(name, clnt->cl_program->name, sizeof(name)); + strncat(name, uniq ? uniq : "", sizeof(name) - strlen(name) - 1); + strncat(name, "_client", sizeof(name) - strlen(name) - 1); ret = sysfs_create_link_nowarn(&server->kobj, &clnt->cl_sysfs->kobject, name); |