Re: seq_buf_putc() and strings

[Alejandro Colomar <alx+linux-hardening@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1536 bytes --]

> Date: 2026-10-28 18:13:43+0100
> From: Alejandro Colomar <alx+linux-hardening@kernel.org>
>
> Hi Steven,
> 
> 
> I've been looking at rewriting seq_buf with pointers instead of sizes.
> While doing that, I've found one place which writes to seq_buf without
> forming a proper string (that is, a null-terminated string).
> 
> 	$ git show v7.3:lib/seq_buf.c | grepc seq_buf_putc
> 	(standard input):int seq_buf_putc(struct seq_buf *s, unsigned char c)
> 	{
> 		WARN_ON(s->size == 0);
> 
> 		if (seq_buf_can_fit(s, 1)) {
> 			s->buffer[s->len++] = c;
> 			return 0;
> 		}
> 		seq_buf_set_overflow(s);
> 		return -1;
> 	}
> 
> I think a safe API for handling strings would have to make sure that it
> *always* holds a string.  I think this function should write a NUL byte
> after the byte written, and so, I suggest doing this:
> 
> 	 		s->buffer[s->len++] = c;
> 	+		s->buffer[s->len] = '\0';
> 
> Are there any reasons to not write that NUL byte?

Or to simplify, we could rewrite the function entirely as:

	 int seq_buf_putc(struct seq_buf *s, unsigned char c)
	 {
	-       WARN_ON(s->size == 0);
	-
	-       if (seq_buf_can_fit(s, 1)) {
	-               s->buffer[s->len++] = c;
	-               return 0;
	-       }
	-       seq_buf_set_overflow(s);
	-       return -1;
	+       return seq_buf_puts(s, (char [2]){c, '\0'});
	 }

It involves one more function call, but I suspect that overhead is
going to be negligible.


Cheers,
Alex

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]