mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-21 10:05:00 +08:00
31998ef193
Device mapper uses sscanf to convert arguments to numbers. The problem is that the way we use it ignores additional unmatched characters in the scanned string. For example, this `if (sscanf(string, "%d", &number) == 1)' will match a number, but also it will match number with some garbage appended, like "123abc". As a result, device mapper accepts garbage after some numbers. For example the command `dmsetup create vg1-new --table "0 16384 linear 254:1bla 34816bla"' will pass without an error. This patch fixes all sscanf uses in device mapper. It appends "%c" with a pointer to a dummy character variable to every sscanf statement. The construct `if (sscanf(string, "%d%c", &number, &dummy) == 1)' succeeds only if string is a null-terminated number (optionally preceded by some whitespace characters). If there is some character appended after the number, sscanf matches "%c", writes the character to the dummy variable and returns 2. We check the return value for 1 and consequently reject numbers with some garbage appended. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Acked-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Alasdair G Kergon <agk@redhat.com>
183 lines
3.8 KiB
C
183 lines
3.8 KiB
C
/*
|
|
* Copyright (C) 2001-2003 Sistina Software (UK) Limited.
|
|
*
|
|
* This file is released under the GPL.
|
|
*/
|
|
|
|
#include "dm.h"
|
|
#include <linux/module.h>
|
|
#include <linux/init.h>
|
|
#include <linux/blkdev.h>
|
|
#include <linux/bio.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/device-mapper.h>
|
|
|
|
#define DM_MSG_PREFIX "linear"
|
|
|
|
/*
|
|
* Linear: maps a linear range of a device.
|
|
*/
|
|
struct linear_c {
|
|
struct dm_dev *dev;
|
|
sector_t start;
|
|
};
|
|
|
|
/*
|
|
* Construct a linear mapping: <dev_path> <offset>
|
|
*/
|
|
static int linear_ctr(struct dm_target *ti, unsigned int argc, char **argv)
|
|
{
|
|
struct linear_c *lc;
|
|
unsigned long long tmp;
|
|
char dummy;
|
|
|
|
if (argc != 2) {
|
|
ti->error = "Invalid argument count";
|
|
return -EINVAL;
|
|
}
|
|
|
|
lc = kmalloc(sizeof(*lc), GFP_KERNEL);
|
|
if (lc == NULL) {
|
|
ti->error = "dm-linear: Cannot allocate linear context";
|
|
return -ENOMEM;
|
|
}
|
|
|
|
if (sscanf(argv[1], "%llu%c", &tmp, &dummy) != 1) {
|
|
ti->error = "dm-linear: Invalid device sector";
|
|
goto bad;
|
|
}
|
|
lc->start = tmp;
|
|
|
|
if (dm_get_device(ti, argv[0], dm_table_get_mode(ti->table), &lc->dev)) {
|
|
ti->error = "dm-linear: Device lookup failed";
|
|
goto bad;
|
|
}
|
|
|
|
ti->num_flush_requests = 1;
|
|
ti->num_discard_requests = 1;
|
|
ti->private = lc;
|
|
return 0;
|
|
|
|
bad:
|
|
kfree(lc);
|
|
return -EINVAL;
|
|
}
|
|
|
|
static void linear_dtr(struct dm_target *ti)
|
|
{
|
|
struct linear_c *lc = (struct linear_c *) ti->private;
|
|
|
|
dm_put_device(ti, lc->dev);
|
|
kfree(lc);
|
|
}
|
|
|
|
static sector_t linear_map_sector(struct dm_target *ti, sector_t bi_sector)
|
|
{
|
|
struct linear_c *lc = ti->private;
|
|
|
|
return lc->start + dm_target_offset(ti, bi_sector);
|
|
}
|
|
|
|
static void linear_map_bio(struct dm_target *ti, struct bio *bio)
|
|
{
|
|
struct linear_c *lc = ti->private;
|
|
|
|
bio->bi_bdev = lc->dev->bdev;
|
|
if (bio_sectors(bio))
|
|
bio->bi_sector = linear_map_sector(ti, bio->bi_sector);
|
|
}
|
|
|
|
static int linear_map(struct dm_target *ti, struct bio *bio,
|
|
union map_info *map_context)
|
|
{
|
|
linear_map_bio(ti, bio);
|
|
|
|
return DM_MAPIO_REMAPPED;
|
|
}
|
|
|
|
static int linear_status(struct dm_target *ti, status_type_t type,
|
|
char *result, unsigned int maxlen)
|
|
{
|
|
struct linear_c *lc = (struct linear_c *) ti->private;
|
|
|
|
switch (type) {
|
|
case STATUSTYPE_INFO:
|
|
result[0] = '\0';
|
|
break;
|
|
|
|
case STATUSTYPE_TABLE:
|
|
snprintf(result, maxlen, "%s %llu", lc->dev->name,
|
|
(unsigned long long)lc->start);
|
|
break;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static int linear_ioctl(struct dm_target *ti, unsigned int cmd,
|
|
unsigned long arg)
|
|
{
|
|
struct linear_c *lc = (struct linear_c *) ti->private;
|
|
struct dm_dev *dev = lc->dev;
|
|
int r = 0;
|
|
|
|
/*
|
|
* Only pass ioctls through if the device sizes match exactly.
|
|
*/
|
|
if (lc->start ||
|
|
ti->len != i_size_read(dev->bdev->bd_inode) >> SECTOR_SHIFT)
|
|
r = scsi_verify_blk_ioctl(NULL, cmd);
|
|
|
|
return r ? : __blkdev_driver_ioctl(dev->bdev, dev->mode, cmd, arg);
|
|
}
|
|
|
|
static int linear_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
|
|
struct bio_vec *biovec, int max_size)
|
|
{
|
|
struct linear_c *lc = ti->private;
|
|
struct request_queue *q = bdev_get_queue(lc->dev->bdev);
|
|
|
|
if (!q->merge_bvec_fn)
|
|
return max_size;
|
|
|
|
bvm->bi_bdev = lc->dev->bdev;
|
|
bvm->bi_sector = linear_map_sector(ti, bvm->bi_sector);
|
|
|
|
return min(max_size, q->merge_bvec_fn(q, bvm, biovec));
|
|
}
|
|
|
|
static int linear_iterate_devices(struct dm_target *ti,
|
|
iterate_devices_callout_fn fn, void *data)
|
|
{
|
|
struct linear_c *lc = ti->private;
|
|
|
|
return fn(ti, lc->dev, lc->start, ti->len, data);
|
|
}
|
|
|
|
static struct target_type linear_target = {
|
|
.name = "linear",
|
|
.version = {1, 1, 0},
|
|
.module = THIS_MODULE,
|
|
.ctr = linear_ctr,
|
|
.dtr = linear_dtr,
|
|
.map = linear_map,
|
|
.status = linear_status,
|
|
.ioctl = linear_ioctl,
|
|
.merge = linear_merge,
|
|
.iterate_devices = linear_iterate_devices,
|
|
};
|
|
|
|
int __init dm_linear_init(void)
|
|
{
|
|
int r = dm_register_target(&linear_target);
|
|
|
|
if (r < 0)
|
|
DMERR("register failed %d", r);
|
|
|
|
return r;
|
|
}
|
|
|
|
void dm_linear_exit(void)
|
|
{
|
|
dm_unregister_target(&linear_target);
|
|
}
|