From ced5fa8b170ad448f4076e24a10c731b5cfb36ce Mon Sep 17 00:00:00 2001 From: Blazej Kucman Date: Fri, 3 Dec 2021 15:31:15 +0100 Subject: mdadm: block creation with long names This fixes buffer overflows in create_mddev(). It prohibits creation with not supported names for DDF and native. For IMSM, mdadm will do silent cut to 16 later. Signed-off-by: Mariusz Tkaczyk Signed-off-by: Blazej Kucman Signed-off-by: Jes Sorensen --- mdadm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'mdadm.c') diff --git a/mdadm.c b/mdadm.c index 91e6746..26299b2 100644 --- a/mdadm.c +++ b/mdadm.c @@ -1359,9 +1359,16 @@ int main(int argc, char *argv[]) mdfd = open_mddev(devlist->devname, 1); if (mdfd < 0) exit(1); - } else + } else { + char *bname = basename(devlist->devname); + + if (strlen(bname) > MD_NAME_MAX) { + pr_err("Name %s is too long.\n", devlist->devname); + exit(1); + } /* non-existent device is OK */ mdfd = open_mddev(devlist->devname, 0); + } if (mdfd == -2) { pr_err("device %s exists but is not an md array.\n", devlist->devname); exit(1); -- cgit v1.2.1