From 9ba2a5cb88969c847015905db7f1627ae3c82f73 Mon Sep 17 00:00:00 2001 From: Sagi Grimberg Date: Wed, 6 Jun 2018 15:27:48 +0300 Subject: nvmet: filter newlines from user input We should avoid consuming the newlines in traddr, trsvcid and device_path. Add minimal processing to make sure they are gone. Reviewed-by: Johannes Thumshirn Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe --- drivers/nvme/target/configfs.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c index ad9ff27234b5..d3f3b3ec4d1a 100644 --- a/drivers/nvme/target/configfs.c +++ b/drivers/nvme/target/configfs.c @@ -137,8 +137,10 @@ static ssize_t nvmet_addr_traddr_store(struct config_item *item, pr_err("Disable the address before modifying\n"); return -EACCES; } - return snprintf(port->disc_addr.traddr, - sizeof(port->disc_addr.traddr), "%s", page); + + if (sscanf(page, "%s\n", port->disc_addr.traddr) != 1) + return -EINVAL; + return count; } CONFIGFS_ATTR(nvmet_, addr_traddr); @@ -208,8 +210,10 @@ static ssize_t nvmet_addr_trsvcid_store(struct config_item *item, pr_err("Disable the address before modifying\n"); return -EACCES; } - return snprintf(port->disc_addr.trsvcid, - sizeof(port->disc_addr.trsvcid), "%s", page); + + if (sscanf(page, "%s\n", port->disc_addr.trsvcid) != 1) + return -EINVAL; + return count; } CONFIGFS_ATTR(nvmet_, addr_trsvcid); @@ -288,7 +292,7 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item, kfree(ns->device_path); ret = -ENOMEM; - ns->device_path = kstrdup(page, GFP_KERNEL); + ns->device_path = kstrndup(page, strcspn(page, "\n"), GFP_KERNEL); if (!ns->device_path) goto out_unlock; -- cgit v1.2.3-59-g8ed1b