On Fri, May 25, 2018 at 6:53 PM, Eric Sandeen <sandeen@xxxxxxxxxx> wrote:...
On 5/25/18 10:14 AM, Arnd Bergmann wrote:
@@ -1860,7 +1860,7 @@ xfs_ioc_setlabel(
spin_lock(&mp->m_sb_lock);
memset(sbp->sb_fname, 0, sizeof(sbp->sb_fname));
- strncpy(sbp->sb_fname, label, sizeof(sbp->sb_fname));
+ memcpy(sbp->sb_fname, label, len);
Hm but len = strnlen(label, XFSLABEL_MAX + 1);
which could be one longer than sbp->sb_fname, no?
We have an explicit check for that, so I think it's ok:
if (len > sizeof(sbp->sb_fname))
return -EINVAL;