diff options
| author | Christophe JAILLET <christophe.jaillet@wanadoo.fr> | 2023-11-25 13:05:04 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-01-25 15:45:30 -0800 |
| commit | 4daed382c477b2e3f9e83ac7a0d5cf33a97e31d2 (patch) | |
| tree | 3f554719f2df6824faef671e1b46dee01e38a744 /kernel/debug/kdb/kdb_main.c | |
| parent | e24bf5b47a5788a8f9c74012c808f5a9bc149a7f (diff) | |
| download | linux-stable-4daed382c477b2e3f9e83ac7a0d5cf33a97e31d2.tar.gz linux-stable-4daed382c477b2e3f9e83ac7a0d5cf33a97e31d2.tar.bz2 linux-stable-4daed382c477b2e3f9e83ac7a0d5cf33a97e31d2.zip | |
kdb: Fix a potential buffer overflow in kdb_local()
[ Upstream commit 4f41d30cd6dc865c3cbc1a852372321eba6d4e4c ]
When appending "[defcmd]" to 'kdb_prompt_str', the size of the string
already in the buffer should be taken into account.
An option could be to switch from strncat() to strlcat() which does the
correct test to avoid such an overflow.
However, this actually looks as dead code, because 'defcmd_in_progress'
can't be true here.
See a more detailed explanation at [1].
[1]: https://lore.kernel.org/all/CAD=FV=WSh7wKN7Yp-3wWiDgX4E3isQ8uh0LCzTmd1v9Cg9j+nQ@mail.gmail.com/
Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'kernel/debug/kdb/kdb_main.c')
| -rw-r--r-- | kernel/debug/kdb/kdb_main.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c index 6b213c8252d6..d05066cb40b2 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c @@ -1348,8 +1348,6 @@ do_full_getstr: /* PROMPT can only be set if we have MEM_READ permission. */ snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"), raw_smp_processor_id()); - if (defcmd_in_progress) - strncat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN); /* * Fetch command from keyboard |