Whamcloud - gitweb
LU-14093 utils: fix DLSYM buffer over flow
authorJames Simmons <jsimmons@infradead.org>
Thu, 20 Jan 2022 00:38:48 +0000 (16:38 -0800)
committerAndreas Dilger <adilger@whamcloud.com>
Mon, 24 Jan 2022 05:41:21 +0000 (05:41 +0000)
The 'name' string passed to DLSYM macro is created from the fsname
buffer in load_backfs_module(). That buffer is greater than 512
bytes in size but the temporary buffer in DLSYM is only 64. The
newest gcc version detect this bug.

mount_utils.c: In function ‘load_backfs_module’:
mount_utils.c:530:36: error: ‘%s’ directive output may be truncated writing up to 507 bytes into a region of size 64 [-Werror=format-truncation=]
  530 |   snprintf(_fname, sizeof(_fname), "%s_%s", prefix, #func); \
      |                                    ^~~~~~~
mount_utils.c:593:2: note: in expansion of macro ‘DLSYM’
  593 |  DLSYM(name, ops, init);

Lustre-change: https://review.whamcloud.com/43938
Lustre-commit: 76bea6ca661609e3788d1cfe7e08e4a63af0a349

Change-Id: I8ae30a5288f236fb9272dffd40f44175e5e03ef9
Signed-off-by: James Simmons <jsimmons@infradead.org>
Reviewed-by: Alex Zhuravlev <bzzz@whamcloud.com>
Reviewed-on: https://review.whamcloud.com/46214
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
lustre/utils/mount_utils.c

index 357003e..1cf7659 100644 (file)
@@ -529,7 +529,7 @@ int loop_format(struct mkfs_opts *mop)
 #ifdef PLUGIN_DIR
 #define DLSYM(prefix, sym, func)                                       \
        do {                                                            \
-               char _fname[64];                                        \
+               char _fname[PATH_MAX];                                  \
                snprintf(_fname, sizeof(_fname), "%s_%s", prefix, #func); \
                sym->func = (typeof(sym->func))dlsym(sym->dl_handle, _fname); \
        } while (0)