| From bc0fd67feba2e0770aad85393500ba77c6489f1c Mon Sep 17 00:00:00 2001 |
| From: Milan Broz <mbroz@redhat.com> |
| Date: Mon, 16 Mar 2009 16:56:01 +0000 |
| Subject: dm ioctl: validate name length when renaming |
| |
| From: Milan Broz <mbroz@redhat.com> |
| |
| commit bc0fd67feba2e0770aad85393500ba77c6489f1c upstream. |
| |
| When renaming a mapped device validate the length of the new name. |
| |
| The rename ioctl accepted any correctly-terminated string enclosed |
| within the data passed from userspace. The other ioctls enforce a |
| size limit of DM_NAME_LEN. If the name is changed and becomes longer |
| than that, the device can no longer be addressed by name. |
| |
| Fix it by properly checking for device name length (including |
| terminating zero). |
| |
| Signed-off-by: Milan Broz <mbroz@redhat.com> |
| Reviewed-by: Jonathan Brassow <jbrassow@redhat.com> |
| Reviewed-by: Alasdair G Kergon <agk@redhat.com> |
| Signed-off-by: Alasdair G Kergon <agk@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/md/dm-ioctl.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/md/dm-ioctl.c |
| +++ b/drivers/md/dm-ioctl.c |
| @@ -704,7 +704,8 @@ static int dev_rename(struct dm_ioctl *p |
| char *new_name = (char *) param + param->data_start; |
| |
| if (new_name < param->data || |
| - invalid_str(new_name, (void *) param + param_size)) { |
| + invalid_str(new_name, (void *) param + param_size) || |
| + strlen(new_name) > DM_NAME_LEN - 1) { |
| DMWARN("Invalid new logical volume name supplied."); |
| return -EINVAL; |
| } |
