summaryrefslogtreecommitdiffstats
path: root/lib
diff options
context:
space:
mode:
authorMichael Ellerman <mpe@ellerman.id.au>2018-10-19 15:21:08 +1100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-02-12 19:46:08 +0100
commit4a38ed76fbeca874c20914e0515f08c8fc7ee0af (patch)
tree31d3566be095c2599fde4b076f5a1b8e870c9210 /lib
parent1812be7e56c7c4447c2facdc52d81a872158a957 (diff)
downloadlinux-stable-4a38ed76fbeca874c20914e0515f08c8fc7ee0af.tar.gz
linux-stable-4a38ed76fbeca874c20914e0515f08c8fc7ee0af.tar.bz2
linux-stable-4a38ed76fbeca874c20914e0515f08c8fc7ee0af.zip
seq_buf: Make seq_buf_puts() null-terminate the buffer
[ Upstream commit 0464ed24380905d640030d368cd84a4e4d1e15e2 ] Currently seq_buf_puts() will happily create a non null-terminated string for you in the buffer. This is particularly dangerous if the buffer is on the stack. For example: char buf[8]; char secret = "secret"; struct seq_buf s; seq_buf_init(&s, buf, sizeof(buf)); seq_buf_puts(&s, "foo"); printk("Message is %s\n", buf); Can result in: Message is fooªªªªªsecret We could require all users to memset() their buffer to zero before use. But that seems likely to be forgotten and lead to bugs. Instead we can change seq_buf_puts() to always leave the buffer in a null-terminated state. The only downside is that this makes the buffer 1 character smaller for seq_buf_puts(), but that seems like a good trade off. Link: http://lkml.kernel.org/r/20181019042109.8064-1-mpe@ellerman.id.au Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'lib')
-rw-r--r--lib/seq_buf.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/lib/seq_buf.c b/lib/seq_buf.c
index 11f2ae0f9099..6aabb609dd87 100644
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -144,9 +144,13 @@ int seq_buf_puts(struct seq_buf *s, const char *str)
WARN_ON(s->size == 0);
+ /* Add 1 to len for the trailing null byte which must be there */
+ len += 1;
+
if (seq_buf_can_fit(s, len)) {
memcpy(s->buffer + s->len, str, len);
- s->len += len;
+ /* Don't count the trailing null byte against the capacity */
+ s->len += len - 1;
return 0;
}
seq_buf_set_overflow(s);