summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSagi Grimberg <sagi@grimberg.me>2018-06-06 15:27:48 +0300
committerJens Axboe <axboe@kernel.dk>2018-06-08 12:51:10 -0600
commit9ba2a5cb88969c847015905db7f1627ae3c82f73 (patch)
tree0a20140ba624428846c3fa66a11149211969d4c4
parentd4c68c7a8e2aa060d3c245052c76e74dd20b141b (diff)
downloadlinux-9ba2a5cb88969c847015905db7f1627ae3c82f73.tar.bz2
nvmet: filter newlines from user input
We should avoid consuming the newlines in traddr, trsvcid and device_path. Add minimal processing to make sure they are gone. Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de> Signed-off-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
-rw-r--r--drivers/nvme/target/configfs.c14
1 files changed, 9 insertions, 5 deletions
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index ad9ff27234b5..d3f3b3ec4d1a 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -137,8 +137,10 @@ static ssize_t nvmet_addr_traddr_store(struct config_item *item,
pr_err("Disable the address before modifying\n");
return -EACCES;
}
- return snprintf(port->disc_addr.traddr,
- sizeof(port->disc_addr.traddr), "%s", page);
+
+ if (sscanf(page, "%s\n", port->disc_addr.traddr) != 1)
+ return -EINVAL;
+ return count;
}
CONFIGFS_ATTR(nvmet_, addr_traddr);
@@ -208,8 +210,10 @@ static ssize_t nvmet_addr_trsvcid_store(struct config_item *item,
pr_err("Disable the address before modifying\n");
return -EACCES;
}
- return snprintf(port->disc_addr.trsvcid,
- sizeof(port->disc_addr.trsvcid), "%s", page);
+
+ if (sscanf(page, "%s\n", port->disc_addr.trsvcid) != 1)
+ return -EINVAL;
+ return count;
}
CONFIGFS_ATTR(nvmet_, addr_trsvcid);
@@ -288,7 +292,7 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
kfree(ns->device_path);
ret = -ENOMEM;
- ns->device_path = kstrdup(page, GFP_KERNEL);
+ ns->device_path = kstrndup(page, strcspn(page, "\n"), GFP_KERNEL);
if (!ns->device_path)
goto out_unlock;