From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A93743E073; Tue, 21 Jul 2026 22:03:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784671407; cv=none; b=T7fTFbepU6y+e+dmkLURY3Vn16VdXQMHxF+kZvSn82AHzpFVA3j9M1dS6W/5L+KB4B5RO1SLPPqx9vemeO2/TrIbcoC8ZOfdkRKxNyRrqD6B4VhWL2FahjNstCVYtgfm1prAMg0k3FyO1xp1C1568OvjaeKzgIW0k4HOVwwi0/Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784671407; c=relaxed/simple; bh=t7RRxOALL23hPEDI2Nx0O2XDCWMWD7pvG+f0xpbf8no=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mUzL5tAKd7yHttm2XLX2gn3AY7+jIzCGkBkxqjX8rJRlWgEwEDhrCO/vf82aNr529cghOh7F5vlScsGORuXbPBh0j7Bl+kdGAzC6yjKKlA3QcIMsS7EsoZf13IKyUrp1gniii3rOt2T0rBQONwNJVpLhn2KPc0OQRARPk101yjg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PMtYCebz; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="PMtYCebz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 956B61F000E9; Tue, 21 Jul 2026 22:03:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784671406; bh=scK5jAWE9oevd3iIf+ByZN3EtHwFjponSN2JhViugHU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=PMtYCebzj3BoY/b3dBjf69RjxWcJQmz0pdFOXop+pL3WCzwp6zU/Boezkqz1VnOCR hfB7LT1mA7y1Pidp2aEXRLlRUn8X3ulRgIaVUZm3GVqP6Q7BMNEeUdonbxnpoKw+S1 qsG4+7G3mJJprDuE6SJhf3Qo2Et2JMPFRZURz0Z8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Pengpeng Hou , Roberto Sassu , Mimi Zohar , Sasha Levin Subject: [PATCH 5.15 235/843] evm: terminate and bound the evm_xattrs read buffer Date: Tue, 21 Jul 2026 17:17:50 +0200 Message-ID: <20260721152411.302030568@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152405.946368001@linuxfoundation.org> References: <20260721152405.946368001@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pengpeng Hou [ Upstream commit 11143a19f5b8dc8f414deab87571134f9f447313 ] evm_read_xattrs() allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlen(temp) to simple_read_from_buffer(). When no configured xattrs are enabled, the fill loop stores nothing and temp[0] remains uninitialized, so strlen() reads beyond initialized memory. Explicitly terminate the buffer after allocation, use snprintf() for each formatted line, and pass the accumulated length, without risk of truncation, to simple_read_from_buffer(). Fixes: fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs") Signed-off-by: Pengpeng Hou Reviewed-by: Roberto Sassu Signed-off-by: Mimi Zohar Signed-off-by: Sasha Levin --- security/integrity/evm/evm_secfs.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c index 8a9db7dfca7efe..93a0d8d554a87e 100644 --- a/security/integrity/evm/evm_secfs.c +++ b/security/integrity/evm/evm_secfs.c @@ -128,8 +128,8 @@ static ssize_t evm_read_xattrs(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { char *temp; - int offset = 0; - ssize_t rc, size = 0; + size_t offset = 0, size = 0; + ssize_t rc; struct xattr_list *xattr; if (*ppos != 0) @@ -152,16 +152,22 @@ static ssize_t evm_read_xattrs(struct file *filp, char __user *buf, return -ENOMEM; } + temp[size] = '\0'; + + /* + * No truncation possible: size is computed over the same enabled + * xattrs under xattr_list_mutex, so offset never exceeds size. + */ list_for_each_entry(xattr, &evm_config_xattrnames, list) { if (!xattr->enabled) continue; - sprintf(temp + offset, "%s\n", xattr->name); - offset += strlen(xattr->name) + 1; + offset += snprintf(temp + offset, size + 1 - offset, "%s\n", + xattr->name); } mutex_unlock(&xattr_list_mutex); - rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp)); + rc = simple_read_from_buffer(buf, count, ppos, temp, offset); kfree(temp); -- 2.53.0