block: do not pass disk names as format strings

Disk names may contain arbitrary strings, so they must not be interpreted
as format strings. It seems that only md allows arbitrary strings to be
used for disk names, but this could allow for a local memory corruption
from uid 0 into ring 0.

CVE-2013-2851

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/block/genhd.c b/block/genhd.c
index e9094b375c05322181eaa66e5946f5b6ca26101a..dadf42b454a383299231fa46abee1631aab53196 100644 (file)
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -512,7 +512,7 @@ static void register_disk(struct gendisk *disk)
 
        ddev->parent = disk->driverfs_dev;
 
-       dev_set_name(ddev, disk->disk_name);
+       dev_set_name(ddev, "%s", disk->disk_name);
 
        /* delay uevents, until we scanned partition table */
        dev_set_uevent_suppress(ddev, 1);

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 037288e7874d625676f5fa9e95a9920ac91551f5..46b35f7acfdeb098eb022a2d9cb2ca1134321ddf 100644 (file)
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -714,7 +714,8 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                else
                        blk_queue_flush(nbd->disk->queue, 0);
 
-               thread = kthread_create(nbd_thread, nbd, nbd->disk->disk_name);
+               thread = kthread_create(nbd_thread, nbd, "%s",
+                                       nbd->disk->disk_name);
                if (IS_ERR(thread)) {
                        mutex_lock(&nbd->tx_lock);
                        return PTR_ERR(thread);

diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index 0fab6b5c7b8293da875bce94b5bdca9a9c97e41a..9d86947d67fe25802b5e172fdd60cd2b08486e8e 100644 (file)
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -485,7 +485,7 @@ static int osd_probe(struct device *dev)
        oud->class_dev.class = &osd_uld_class;
        oud->class_dev.parent = dev;
        oud->class_dev.release = __remove;
-       error = dev_set_name(&oud->class_dev, disk->disk_name);
+       error = dev_set_name(&oud->class_dev, "%s", disk->disk_name);
        if (error) {
                OSD_ERR("dev_set_name failed => %d\n", error);
                goto err_put_cdev;