+1
−1
Loading
erofs_ioctl_get_volume_label() passes strlen(sbi->volume_name) as the length to copy_to_user(), which copies the label string without the trailing NUL byte. Since FS_IOC_GETFSLABEL callers expect a NUL-terminated string in the FSLABEL_MAX-sized buffer and may not pre-zero the buffer, this can cause userspace to read past the label into uninitialised stack memory. Fix this by using strlen() + 1 to include the NUL terminator, consistent with how ext4 and xfs implement FS_IOC_GETFSLABEL. Signed-off-by:Zhan Xusheng <zhanxusheng@xiaomi.com> Fixes: 1cf12c71 ("erofs: Add support for FS_IOC_GETFSLABEL") Reviewed-by:
Gao Xiang <hsiangkao@linux.alibaba.com> Reviewed-by:
Chunhai Guo <guochunhai@vivo.com> Signed-off-by:
Gao Xiang <hsiangkao@linux.alibaba.com>