From nobody Sat Jul 25 20:05:58 2026 Received: from mail-qt1-f176.google.com (mail-qt1-f176.google.com [209.85.160.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C3CCB34CFB9 for ; Tue, 14 Jul 2026 07:05:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784012729; cv=none; b=aEPztB19Ivgx014aNbWksZLMIKfSGyrdvMIiPdELg2og6Mm1SWVQ6Dy7veTdYLHtqEdyS+IO04KHk9gvvHTWoDUTnAzR870qRdK6+IwExv/mRuwVoNPt1Vw78WTiSzCMpcdkxppRn1vNZKiol2eiVAgyhWzv2Cp7CzTJc56Jnew= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784012729; c=relaxed/simple; bh=mCH1FyiI4coYf3+nX8ZZVVt0ChWSiEy1l1DWJvxXU+k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iI+Bv4Ah9yvt6AFJBc3x9Gf9W8Wknm6MxX5wK24AmUlb5VSLYZiRAJ/UGNyY5Rpz+tV1NZSgwfHmDhquNFX5MCXUDbx3XemvSj0+UCtUwVA6mdWz0vAYHaikUcXr1W2iNX4+tLmSkX9oB+BuYbkuywW5wh50TLJgKLy/VyjU/O4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=huiR2E/p; arc=none smtp.client-ip=209.85.160.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="huiR2E/p" Received: by mail-qt1-f176.google.com with SMTP id d75a77b69052e-51c1d487f2cso6916501cf.1 for ; Tue, 14 Jul 2026 00:05:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1784012727; x=1784617527; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Yh+aO0m/49qC5Uc6JLGvylmvvIFt72TxxjLyyJIYzfQ=; b=huiR2E/pFCZ0ORGeFFzNUAIWmbK8WXg4w1JG477Z5f4nnAPDJqlIJxofOr3znyTRdY K282B5qp09kHvkgSYbDGHUeaS8QrenCV9ckWJp+oUSOzJ5Iec5xuvoeLUWaipg71KvtD hP0VZnBgCYCSbliuzLPqkgQZEE48+VSSRWT8qmjOO8TMQ5XDPsr+khBs3hdsBwC2BCHs SwgkUMC4a3B1LE4Ah/DaDejfFW5D3Bw/7tpiCUJNt4khKIaqgervWGzchjfQZwkjnTY8 4L0zpTFCeFBsfZfFydgw1njWBGAbxCICKbFtP4ychAhV+wAEbkrDxT1s/tkTrjiGJZui f+UQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784012727; x=1784617527; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Yh+aO0m/49qC5Uc6JLGvylmvvIFt72TxxjLyyJIYzfQ=; b=qBe4fBUmg8AvFiQpdhhpxvVb6bTZJr9djrzHNPES9sMm5aVx4AOzZOZqUCnrlEFwgC RqtYNPacmwfNXZuL+LaLDIfFQd3ARiXwYiDeKEA7Xr4I9oddo7f3wSNP/1cU8ProDlWf nldM/gU/4qAphbXeD9Cj3NveHi96ot0FNUEq1+TZ5+HPL49nt762vUYmyTo3CXqCgYdv wDnJRKFyyOQxhRd/aqc67x0d93YlA2f+WVkjby1fniec1wT1v88eSoDSgMcJqTXhDtHK fPyXsbaofmr1Kc9EyaDm36Xbt7DXABh8AGY2JICldcjKKB8EqppdDv843ozZ4413lWyT +5ww== X-Forwarded-Encrypted: i=1; AHgh+RoiuV1tZQCtvehu93ayVPvRuMyT0OjEtZ85nnW6bL5qTybqBTB8oDVrr9w2dWsdZc0mmyOLhjoHzBdkZ24=@vger.kernel.org X-Gm-Message-State: AOJu0YyTvIwzqydWJohJ95twV0RZeCMlhURP+cwIWYAYPcoHqteFmLRu M/RB/38mjHfwYeP3NIiNg9w5lSqZgdlqDVUDfCxinSaVtlUySCMamfX3P4HpWHUvj38= X-Gm-Gg: AfdE7ckhJYCJvTT30cGrunaxgC+EVU+B8jyGzlS8KB23vH0sjQP73ThPKsTOUIPCKp5 lGLgq4rbLVZfVxpHfLrp1NHqsSs6OXvuvPCIjbHUDYpnn66JFNEGkqNN1MiLi9RwfbI30X/oi7j LYXAEAP4qmWzKnR69zmqjLzdGo8tpLGYebXlVz7SIYQQD9/LwYbqiTsCrem725lcmrBFgd35Zbb 5vmY4vWOKhmXE2zhZtAmPUXS+BbjOo2sE0xO6ekSVJbiJCsYd5xQo1KLb1w/yMZjvYCZ55GLWEw O2NQ4yEgamOqIRY9SZl0PiLiBvsxbWzZ+g1DQCXQtfwYVOusgRM2zWCB8r/R6EvdoZw8yPOsiLB ByP6FfQnnaY0E/8BV4mEprXmdoj3e2Mbp4f0cZPkwVlQcJHg7sIql/sy6Ov1KSFM6L5No/gEJ2Q iN7Ist4WMGKvZ6tsJdk65NDOo9VjaO X-Received: by 2002:ac8:5f4d:0:b0:51a:8c97:fb94 with SMTP id d75a77b69052e-51cbf2ee7a4mr130660681cf.61.1784012726657; Tue, 14 Jul 2026 00:05:26 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id d75a77b69052e-51caae24d04sm103487761cf.18.2026.07.14.00.05.26 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 14 Jul 2026 00:05:26 -0700 (PDT) From: David Lee To: Bob Copeland Cc: David Lee , linux-karma-devel@lists.sourceforge.net, Dominik 'Disconnect3d' Czarnota , linux-kernel@vger.kernel.org Subject: [PATCH] omfs: avoid overread when printing volume label Date: Tue, 14 Jul 2026 07:05:22 +0000 Message-ID: <20260714070524.1699081-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" omfs_fill_super() prints the root-block volume label with %s. The label is the on-disk omfs_root_block::r_name field, a fixed OMFS_NAMELEN byte array that need not contain a terminating NUL byte. A crafted image can place a non-terminated label at the end of the root block buffer. The formatter then scans past the label while mounting the image, and KASAN reports an out-of-bounds read from the formatting path. Print the label with a precision capped at OMFS_NAMELEN. This keeps formatting from reading beyond the on-disk array. Signed-off-by: David Lee Assisted-by: Codex:gpt-5.5 --- Trail of Bits has a reproducer for this bug demonstrating Kernel Panic whic= h can be shared further if needed. fs/omfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c index 1d915ef72119..ea51c1bc3eee 100644 --- a/fs/omfs/inode.c +++ b/fs/omfs/inode.c @@ -590,7 +590,7 @@ static int omfs_fill_super(struct super_block *sb, stru= ct fs_context *fc) ret =3D -ENOMEM; goto out_brelse_bh2; } - printk(KERN_DEBUG "omfs: Mounted volume %s\n", omfs_rb->r_name); + pr_debug("Mounted volume %.*s\n", OMFS_NAMELEN, omfs_rb->r_name); =20 ret =3D 0; out_brelse_bh2: --=20 2.43.0