Re: [PATCH v1 1/3] jbd2: Avoid printing out the boundary

From: Jan Kara
Date: Thu Mar 23 2023 - 05:55:39 EST


On Wed 22-03-23 16:12:04, Andy Shevchenko wrote:
> Theoretically possible that "%pg" will take all room for the j_devname
> and hence the "-%lu" will go out the boundary due to unconditional
> sprintf() in use. To make this code more robust, replace two sequential
> s*printf():s by a single call and then replace forbidden character.
> It's possible to do this way, because '/' won't ever be in the result
> of "-%lu".
>
> Signed-off-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>

Looks good. Feel free to add:

Reviewed-by: Jan Kara <jack@xxxxxxx>

Honza

> ---
> fs/jbd2/journal.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
> index 8ae419152ff6..00c0aa4a3a91 100644
> --- a/fs/jbd2/journal.c
> +++ b/fs/jbd2/journal.c
> @@ -1515,9 +1515,8 @@ journal_t *jbd2_journal_init_inode(struct inode *inode)
>
> journal->j_inode = inode;
> snprintf(journal->j_devname, sizeof(journal->j_devname),
> - "%pg", journal->j_dev);
> - p = strreplace(journal->j_devname, '/', '!');
> - sprintf(p, "-%lu", journal->j_inode->i_ino);
> + "%pg-%lu", journal->j_dev, journal->j_inode->i_ino);
> + strreplace(journal->j_devname, '/', '!');
> jbd2_stats_proc_init(journal);
>
> return journal;
> --
> 2.40.0.1.gaa8946217a0b
>
--
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR