[PATCH] FAT/VFAT memory corruption during mount()

This patch fixes memory corruption during vfat mount: one byte
before mount options is overwritten by ',' since strtok->strsep
conversion happened.

This patch also fixes another problem introduced by strtok->strsep
conversion: VFAT requires that FAT does not modify passed options,
but unfortunately FAT driver fails to preserve options string if
there is more than one consecutive comma in option string.

diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 79a5576740c5b4f1a85107665b2e52a522f98bd8..6f9aa6efec1e327d0be541e9f8898e0623bc0112 100644 (file)
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -228,8 +228,6 @@ static int parse_options(char *options, int *debug,
        save = 0;
        savep = NULL;
        while ((this_char = strsep(&options,",")) != NULL) {
-               if (!*this_char)
-                       continue;
                if ((value = strchr(this_char,'=')) != NULL) {
                        save = *value;
                        savep = value;
@@ -351,7 +349,7 @@ static int parse_options(char *options, int *debug,
                        strncpy(cvf_options,value,100);
                }
 
-               if (this_char != options) *(this_char-1) = ',';
+               if (options) *(options-1) = ',';
                if (value) *savep = save;
                if (ret == 0)
                        break;

diff --git a/fs/vfat/namei.c b/fs/vfat/namei.c
index b6d2dd1c18a9fd6828ce46b2d4b1ced901d8914d..91077f849c2e7ec8077d7b83e231311a4fd4cd2d 100644 (file)
--- a/fs/vfat/namei.c
+++ b/fs/vfat/namei.c
@@ -117,8 +117,6 @@ static int parse_options(char *options,     struct fat_mount_options *opts)
        savep = NULL;
        ret = 1;
        while ((this_char = strsep(&options,",")) != NULL) {
-               if (!*this_char)
-                       continue;
                if ((value = strchr(this_char,'=')) != NULL) {
                        save = *value;
                        savep = value;
@@ -154,8 +152,8 @@ static int parse_options(char *options,     struct fat_mount_options *opts)
                        else
                                ret = 0;
                }
-               if (this_char != options)
-                       *(this_char-1) = ',';
+               if (options)
+                       *(options-1) = ',';
                if (value) {
                        *savep = save;
                }