From: Fedor Pchelkin Date: Sat, 1 Nov 2025 16:04:29 +0000 (+0300) Subject: ext4: check if mount_opts is NUL-terminated in ext4_ioctl_set_tune_sb() X-Git-Tag: v6.19-rc1~161^2~36 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3db63d2c2d1d1e78615dd742568c5a2d55291ad1;p=thirdparty%2Fkernel%2Flinux.git ext4: check if mount_opts is NUL-terminated in ext4_ioctl_set_tune_sb() params.mount_opts may come as potentially non-NUL-term string. Userspace is expected to pass a NUL-term string. Add an extra check to ensure this holds true. Note that further code utilizes strscpy_pad() so this is just for proper informing the user of incorrect data being provided. Found by Linux Verification Center (linuxtesting.org). Signed-off-by: Fedor Pchelkin Reviewed-by: Baokun Li Reviewed-by: Jan Kara Message-ID: <20251101160430.222297-2-pchelkin@ispras.ru> Signed-off-by: Theodore Ts'o Cc: stable@kernel.org --- diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 366a9b615bf08..7ce0fc40aec2f 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -1394,6 +1394,10 @@ static int ext4_ioctl_set_tune_sb(struct file *filp, if (copy_from_user(¶ms, in, sizeof(params))) return -EFAULT; + if (strnlen(params.mount_opts, sizeof(params.mount_opts)) == + sizeof(params.mount_opts)) + return -E2BIG; + if ((params.set_flags & ~TUNE_OPS_SUPPORTED) != 0) return -EOPNOTSUPP;