From: Zhiling Zou AIX logical volume names are stored on disk as fixed-size fields. The partition parser reads them into struct lvname, but later formats the fields with %s. If an on-disk name is not NUL-terminated, the string formatting code can keep reading past the end of the 64-byte name field. Limit the formatted string length to the size of the on-disk name field when printing AIX logical volume names. Fixes: 6ceea22bbbc8 ("partitions: add aix lvm partition support files") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Xin Liu Signed-off-by: Zhiling Zou Signed-off-by: Ren Wei --- changes in v2: - Print non-contiguous LV names directly with a bounded %.*s format in pr_warn() instead of copying them through a temporary buffer. - v1 Link: https://lore.kernel.org/all/6f381f63ccfe458e15067fd9b9428884cb8d5f97.1782407859.git.roxy520tt@gmail.com/ block/partitions/aix.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/block/partitions/aix.c b/block/partitions/aix.c index f3c4174e003e..fe2d2cb0c4e7 100644 --- a/block/partitions/aix.c +++ b/block/partitions/aix.c @@ -261,7 +261,8 @@ int aix_partition(struct parsed_partitions *state) put_partition(state, lv_ix + 1, (i + 1 - lp_ix) * pp_blocks_size + psn_part1, lvip[lv_ix].pps_per_lv * pp_blocks_size); - seq_buf_printf(&state->pp_buf, " <%s>\n", + seq_buf_printf(&state->pp_buf, " <%.*s>\n", + (int)sizeof(n[lv_ix].name), n[lv_ix].name); lvip[lv_ix].lv_is_contiguous = 1; ret = 1; @@ -271,12 +272,10 @@ int aix_partition(struct parsed_partitions *state) } for (i = 0; i < state->limit; i += 1) if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) { - char tmp[sizeof(n[i].name) + 1]; // null char - - snprintf(tmp, sizeof(tmp), "%s", n[i].name); - pr_warn("partition %s (%u pp's found) is " + pr_warn("partition %.*s (%u pp's found) is " "not contiguous\n", - tmp, lvip[i].pps_found); + (int)sizeof(n[i].name), n[i].name, + lvip[i].pps_found); } kfree(pvd); } -- 2.43.0