dm ioctl: validate name length when renaming

When renaming a mapped device validate the length of the new name. The rename ioctl accepted any correctly-terminated string enclosed within the data passed from userspace. The other ioctls enforce a size limit of DM_NAME_LEN. If the name is changed and becomes longer than that, the device can no longer be addressed by name. Fix it by properly checking for device name length (including terminating zero). Cc: [email protected] Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Jonathan Brassow <[email protected]> Reviewed-by: Alasdair G Kergon <[email protected]> Signed-off-by: Alasdair G Kergon <[email protected]>
klaby · Mar 16, 2009 · bc0fd67 · bc0fd67
1 parent 5bee17f
commit bc0fd67
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
@@ -704,7 +704,8 @@ static int dev_rename(struct dm_ioctl *param, size_t param_size)
 	char *new_name = (char *) param + param->data_start;
 
 	if (new_name < param->data ||
-	    invalid_str(new_name, (void *) param + param_size)) {
+	    invalid_str(new_name, (void *) param + param_size) ||
+	    strlen(new_name) > DM_NAME_LEN - 1) {
 		DMWARN("Invalid new logical volume name supplied.");
 		return -EINVAL;
 	}