]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
erofs: include the trailing NUL in FS_IOC_GETFSLABEL
authorZhan Xusheng <zhanxusheng1024@gmail.com>
Wed, 1 Apr 2026 06:13:42 +0000 (14:13 +0800)
committerGao Xiang <hsiangkao@linux.alibaba.com>
Thu, 2 Apr 2026 08:08:49 +0000 (16:08 +0800)
commitd6250d49da4d8f11afc0d8991c84e0307949f92e
tree5c727473539c8e753f0206d84d9429fb2b9ea4fb
parent5de6951fedb29700ace53b283ccb951c8f712d12
erofs: include the trailing NUL in FS_IOC_GETFSLABEL

erofs_ioctl_get_volume_label() passes strlen(sbi->volume_name) as
the length to copy_to_user(), which copies the label string without
the trailing NUL byte.  Since FS_IOC_GETFSLABEL callers expect a
NUL-terminated string in the FSLABEL_MAX-sized buffer and may not
pre-zero the buffer, this can cause userspace to read past the label
into uninitialised stack memory.

Fix this by using strlen() + 1 to include the NUL terminator,
consistent with how ext4 and xfs implement FS_IOC_GETFSLABEL.

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Fixes: 1cf12c717741 ("erofs: Add support for FS_IOC_GETFSLABEL")
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Reviewed-by: Chunhai Guo <guochunhai@vivo.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
fs/erofs/inode.c