From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A095C83F03 for ; Sun, 6 Jul 2025 17:37:52 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E92B08D0003; Sun, 6 Jul 2025 13:37:48 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D0BCF8D0002; Sun, 6 Jul 2025 13:37:48 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AC2A66B0402; Sun, 6 Jul 2025 13:37:48 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 827FF6B0400 for ; Sun, 6 Jul 2025 13:37:48 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 2A3F0C019A for ; Sun, 6 Jul 2025 17:37:48 +0000 (UTC) X-FDA: 83634547416.30.C64480D Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by imf24.hostedemail.com (Postfix) with ESMTP id 71403180011 for ; Sun, 6 Jul 2025 17:37:46 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=orXVAk+F; spf=pass (imf24.hostedemail.com: domain of alx@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=alx@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=orXVAk+F; spf=pass (imf24.hostedemail.com: domain of alx@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=alx@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1751823466; a=rsa-sha256; cv=none; b=5UOUdpEw2qD7FgebbBREVNT13Kcb8yr5Z4+ZBoiCs54CqSgpsPt+J0CjjYXNsHKDoV16QS 1/R7YPmQZxHro22jVGTpBF8DEisGLDIfIDWjqa5WrQYuUCpS9VxpCxoJKXrMriSAbC8vQq gurhZXSP7X9vJ1TyafvVDBAtKVUfuKA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1751823466; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=39KAwZRzDNDC6hWvgyKPYwRRM/G8G1bD8GxjYQKK8io=; b=SJJo6SI+KFji9Qafl1+P89aIVh/3Fvpg30FTsMNPLwV6vFmW/4HUxPx8435P9sHjUFll4y Qqsezzlpu1UAJEbr+g05DjWtR5wDfjN79vGI0kuqYtt1W8bEn3SDqQuDsGE2UeAsZA5lrl FXcwv3P9UIQ88JsR41IM0ZMaARMa9ts= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 0B1B545DEE; Sun, 6 Jul 2025 17:37:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C8C44C4CEF2; Sun, 6 Jul 2025 17:37:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1751823464; bh=y/NagA9ATWYzQCU9rSacENdhdRjkHrBaR2aM75AXuY4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=orXVAk+FU306mzqc4WhNNGyh/QPVlsfnq/ha7OFRjsYJOwSW73KjZW8tCUBpZgyDP mbORBDmTYFZkpLbehJgkJhLq/4ZCIXhjynSsAGwf0EqUWpnGo/Muxyl1CI90UJJKtj ezTaWG8VARDp4Moj71p1hYDbGgLV4RsFLq2LjYpilvFJoDjIE/TwQ1q+qt20QQdgxw JBWIvDsbrB7vbp7xFHVyRLxEANRyUi9+tRBHqj0kmmt5xyTInSbKrGqGtdo4VNYKQl wEZTKnNAeDUvtJTb5fRkixKidZjrtzA220veml1DsWHOnnKWfa5unpoP4QXeKE64pL Mn9V6k6yePUzw== Date: Sun, 6 Jul 2025 19:37:42 +0200 From: Alejandro Colomar To: linux-mm@kvack.org, linux-hardening@vger.kernel.org Cc: Alejandro Colomar , Kees Cook , Christopher Bazley , shadow <~hallyn/shadow@lists.sr.ht>, linux-kernel@vger.kernel.org, Andrew Morton , kasan-dev@googlegroups.com, Dmitry Vyukov , Alexander Potapenko , Marco Elver , Christoph Lameter , David Rientjes , Vlastimil Babka , Roman Gushchin , Harry Yoo , Andrew Clayton Subject: [RFC v2 5/5] mm: Fix benign off-by-one bugs Message-ID: <08cfdd2bf77911ca6ce3c0b6c310daea77eb307a.1751823326.git.alx@kernel.org> X-Mailer: git-send-email 2.50.0 References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 71403180011 X-Stat-Signature: wsbskyf9zt6hyq9qihxwhy65gxoa9j7p X-Rspam-User: X-HE-Tag: 1751823466-755873 X-HE-Meta: U2FsdGVkX186ecjesML4fdCsC9L2x+8W4rVLO1RY6u0oyVE1VDxo2+md7YhqY6g/JWfFyQofgiMmW9fSZuLtcQcWQx/0KuxC0jYxayTIctY83EMdcWDqa0ciXvKnmtJWSd6NhpyyRUGsgrhsEVjNAVG/HcQsnm34nc66+heJEStGkzrPbp8pVp5EvIA898wjHeCttGneE3yxfLYjLqLcPPba+kSnLUFLp2SVW04lZCTebs/BfY9MNr/DWV1P1BEi1FikVFo81LD2Ere+A3KPOgQcSwdlcnvc7SWs7ORaPdaZINRGbaEpmcFFNXwUc2L4NPHFUQ/5vYZUyZ3zoROGZZPYXvBGFqFM6iGdeo7qQeYk7lx316ZQgZSsp2eg+jBrOjx4DGQdI1fOwV8da0qvpsuxSXU91bbslX1IMjve9XcCQYbmlcwnWzW8Gak534NDsmrELiEHVoWYJvEUquF0idp1xWNpgvnsfQwK4EC/WRRBzP3B1/PIdqAHqCS+B1vtN6X6X09W56pFbGgSTNDk6l0evktr3HrxUt+7Fz5vvNs/Z8h23GOUvhiFDDoX09T6aidbXfJgAhzZ8LQjCePxPZlyAs5/1IY604sUNPnTCdWoUPiaA0eO13wpqt9oG6rUeB/HauBkeO0MKNzWsL/70ThHImG+aHyphxhI5G6hAF5xT+1jVINCbXEHOMcd+hmJ51JCRnQ8FQsjddcqNZFyy3XFDUmfxFf3JMw90yeFJ0d9rACCZXBq+ofjZglkfEnzCjVpknUUv5898LsJMfk60PlMm5kWfohWtdq6zaeofDT8hM+A8+/g29QzJ+oA2JnWRg12aQiuAAyS99/gpndlZs8cslJklQWsu2PgoQ7UNDy9kJc8fqmmjPpFejMzO615OSQ6NqcOjfQyHzOaR6Tds4mMv02Z5FVCwSdtaKmBxD9ZRa2REISP5+sIAkmcipEVDzmJbBoRr4+xi+V6HdM uv4E7pBP 9vVT5nHAA5zVZBvhZbYsG5Fp5GvMa/NcZ6GtE6nahtNmjBhXSJDSeLt2nynkiByAV32Lpt38qp7PtlffsWhuVoRpA7Ss5722pXw1VEBCd3nI+jJOAwKRHpA6USsXak94qzYfdazRmNTR/jBcCYWQ4xXR4po3D+lo4Uz0/MB4IeF4XG+fcCrW7Qa/CujXhDcJBYmkzLdkzt9qeU+r1wv9vkajpwWGFMoLBgABmPbW/764ZN6qmW+dVlp9Mik8Rbpv7e/ERSgrLZn2flul6Vp2OwyKa17R/RLVuLX3r29SjIxVViBAbuqVllvSq/pAUm8QDJ4XZgWAQB1cdKcF5eA1EwBZoZg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: We were wasting a byte due to an off-by-one bug. s[c]nprintf() doesn't write more than $2 bytes including the null byte, so trying to pass 'size-1' there is wasting one byte. Now that we use seprintf(), the situation isn't different: seprintf() will stop writing *before* 'end' --that is, at most the terminating null byte will be written at 'end-1'--. Cc: Kees Cook Cc: Christopher Bazley Signed-off-by: Alejandro Colomar --- mm/kfence/kfence_test.c | 4 ++-- mm/kmsan/kmsan_test.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/mm/kfence/kfence_test.c b/mm/kfence/kfence_test.c index ff734c514c03..f02c3e23638a 100644 --- a/mm/kfence/kfence_test.c +++ b/mm/kfence/kfence_test.c @@ -110,7 +110,7 @@ static bool report_matches(const struct expect_report *r) /* Title */ cur = expect[0]; - end = &expect[0][sizeof(expect[0]) - 1]; + end = ENDOF(expect[0]); switch (r->type) { case KFENCE_ERROR_OOB: cur = seprintf(cur, end, "BUG: KFENCE: out-of-bounds %s", @@ -140,7 +140,7 @@ static bool report_matches(const struct expect_report *r) /* Access information */ cur = expect[1]; - end = &expect[1][sizeof(expect[1]) - 1]; + end = ENDOF(expect[1]); switch (r->type) { case KFENCE_ERROR_OOB: diff --git a/mm/kmsan/kmsan_test.c b/mm/kmsan/kmsan_test.c index a062a46b2d24..882500807db8 100644 --- a/mm/kmsan/kmsan_test.c +++ b/mm/kmsan/kmsan_test.c @@ -105,7 +105,7 @@ static bool report_matches(const struct expect_report *r) /* Title */ cur = expected_header; - end = &expected_header[sizeof(expected_header) - 1]; + end = ENDOF(expected_header); cur = seprintf(cur, end, "BUG: KMSAN: %s", r->error_type); -- 2.50.0