From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759308AbbCDUV0 (ORCPT ); Wed, 4 Mar 2015 15:21:26 -0500 Received: from smtprelay0181.hostedemail.com ([216.40.44.181]:54297 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753261AbbCDUVZ (ORCPT ); Wed, 4 Mar 2015 15:21:25 -0500 X-Session-Marker: 6A6F6540706572636865732E636F6D X-Spam-Summary: 30,2,0,,d41d8cd98f00b204,joe@perches.com,:::::::::,RULES_HIT:41:355:379:541:599:800:960:973:988:989:1260:1277:1311:1313:1314:1345:1359:1373:1437:1515:1516:1518:1534:1542:1593:1594:1711:1730:1747:1777:1792:2393:2553:2559:2562:2693:2828:3138:3139:3140:3141:3142:3355:3622:3865:3866:3867:3868:3870:3871:3872:3874:4321:5007:6261:8603:9040:10010:10400:10848:11026:11232:11658:11914:12043:12296:12438:12517:12519:12740:13869:21080,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fn,MSBL:0,DNSBL:none,Custom_rules:0:1:0 X-HE-Tag: ghost71_464df5ceeff4b X-Filterd-Recvd-Size: 3715 Message-ID: <1425500481.2712.27.camel@perches.com> Subject: Re: [GIT PULL] seq_buf: Fix seq_buf_vprintf() truncation From: Joe Perches To: Steven Rostedt Cc: Linus Torvalds , LKML , Ingo Molnar , Andrew Morton Date: Wed, 04 Mar 2015 12:21:21 -0800 In-Reply-To: <20150304151248.23ef8f78@gandalf.local.home> References: <20150304151248.23ef8f78@gandalf.local.home> Content-Type: text/plain; charset="ISO-8859-1" X-Mailer: Evolution 3.12.10-0ubuntu1~14.10.1 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 2015-03-04 at 15:12 -0500, Steven Rostedt wrote: > Linus, > > While working on merging seq_file and seq_buf code, I hit a bug and came > down to a bug in seq_buf_printf(). This is suppose to be a all or nothing > function. That is, either all of the string passed in is saved to the > seq_buf buffer, or none of it. But due to the way vsnprintf() works in > the kernel, if the line is truncated, the return value is the amount > written to the buffer, including the '\0'. Then the test in seq_buf_printf() > uses the returned length to see if it would fit in the buffer. It will, > but it will also fill the buffer. The test to see if vsnprintf() overflowed > or not is to see if the length returned is equal to or greater than > the length of the buffer passed to it. Not just greater than. > > Please pull the latest trace-fixes-v4.0-rc2 tree, which can be found at: [] > commit 4a8fe4e1811c96ad0ad9f4083f2fe4fb43b2988d > Author: Steven Rostedt (Red Hat) > Date: Wed Mar 4 09:56:02 2015 -0500 > > seq_buf: Fix seq_buf_vprintf() truncation > > In seq_buf_vprintf(), vsnprintf() is used to copy the format into the > buffer remaining in the seq_buf structure. The return of vsnprintf() > is the amount of characters written to the buffer excluding the '\0', > unless the line was truncated! > > If the line copied does not fit, it is truncated, and a '\0' is added > to the end of the buffer. But in this case, '\0' is included in the length > of the line written. To know if the buffer had overflowed, the return > length will be the same as the length of the buffer passed in. > > The check in seq_buf_vprintf() only checked if the length returned from > vsnprintf() would fit in the buffer, as the seq_buf_vprintf() is only > to be an all or nothing command. It either writes all the string into > the seq_buf, or none of it. If the string is truncated, the pointers > inside the seq_buf must be reset to what they were when the function was > called. This is not the case. On overflow, it copies only part of the string. > > The fix is to change the overflow check to see if the length returned from > vsnprintf() is less than the length remaining in the seq_buf buffer, and not > if it is less than or equal to as it currently does. Then seq_buf_vprintf() > will know if the write from vsnpritnf() was truncated or not. [] > diff --git a/lib/seq_buf.c b/lib/seq_buf.c [] > @@ -61,7 +61,7 @@ int seq_buf_vprintf(struct seq_buf *s, const char *fmt, va_list args) > > if (s->len < s->size) { > len = vsnprintf(s->buffer + s->len, s->size - s->len, fmt, args); Presumably the seq_buf_bprintf function has the same issue.