Re: seq_buf_str() silent truncation (data corruption)

[Alejandro Colomar <alx+linux-hardening@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1230 bytes --]

Hi Kees,

> Date: 2026-10-28 21:04:44-0400
> From: Steven Rostedt <rostedt@goodmis.org>
>
> On Wed, 28 Oct 2026 22:30:38 +0100
> Alejandro Colomar <alx+linux-hardening@kernel.org> wrote:
> 
> > Let's see the implementation of seq_buf_str():
> > 
> > 	$ git show v7.3:include/linux/seq_buf.h | grepc seq_buf_str
> > 	(standard input):static inline const char *seq_buf_str(struct seq_buf *s)
> > 	{
> > 		if (WARN_ON(s->size == 0))
> > 			return "";
> > 
> > 		if (seq_buf_buffer_left(s))
> > 			s->buffer[s->len] = 0;
> > 		else
> > 			s->buffer[s->size - 1] = 0;
> > 
> > 		return s->buffer;
> > 	}
> > 
> > The first check is fine (we don't trigger the WARN_ON()).
> > seq_buf_buffer_left(s) will return 0 (it returns 's->size - s->len').
> > This means we'll execute the second branch.  That branch will result in
> > overwriting the third byte with a '\0', without reporting the overflow.
> 
> Yes, Kees and I already discussed this:
> 
>   https://lore.kernel.org/all/20261016145928.16eddc9a@gandalf.local.home/

Oh, indeed!  I didn't understand it enough back then so didn't relate it
to this.  :-)


Have a lovely day!
Alex

> 
> -- Steve

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]