* [RESEND][PATCH] scsi: esas2r: fix potential format string flaw
@ 2013-12-17 18:27 Kees Cook
2013-12-17 20:00 ` Greg Kroah-Hartman
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Kees Cook @ 2013-12-17 18:27 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, Bradley Grove, James E.J. Bottomley, linux-scsi
This makes sure format strings cannot leak into the printk call via the
constructed buffer.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/scsi/esas2r/esas2r_log.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/esas2r/esas2r_log.c b/drivers/scsi/esas2r/esas2r_log.c
index 9bf285df58dd..61fc19d296bd 100644
--- a/drivers/scsi/esas2r/esas2r_log.c
+++ b/drivers/scsi/esas2r/esas2r_log.c
@@ -171,7 +171,7 @@ static int esas2r_log_master(const long level,
if (strlen(event_buffer) < buflen)
strcat(buffer, "\n");
- printk(event_buffer);
+ printk("%s", event_buffer);
spin_unlock_irqrestore(&event_buffer_lock, flags);
}
--
1.7.9.5
--
Kees Cook
Chrome OS Security
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [RESEND][PATCH] scsi: esas2r: fix potential format string flaw
2013-12-17 18:27 [RESEND][PATCH] scsi: esas2r: fix potential format string flaw Kees Cook
@ 2013-12-17 20:00 ` Greg Kroah-Hartman
2013-12-17 21:17 ` Kees Cook
2013-12-17 21:45 ` Bradley Grove
2013-12-18 5:42 ` Joe Perches
2 siblings, 1 reply; 7+ messages in thread
From: Greg Kroah-Hartman @ 2013-12-17 20:00 UTC (permalink / raw)
To: Kees Cook; +Cc: linux-kernel, Bradley Grove, James E.J. Bottomley, linux-scsi
On Tue, Dec 17, 2013 at 10:27:33AM -0800, Kees Cook wrote:
> This makes sure format strings cannot leak into the printk call via the
> constructed buffer.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> drivers/scsi/esas2r/esas2r_log.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Why is this patch "To:" me? I'm not the author of this driver, or the
maintainer of it or the subsystem, and there's not much, if anything I
can do with it...
confused,
greg k-h
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RESEND][PATCH] scsi: esas2r: fix potential format string flaw
2013-12-17 20:00 ` Greg Kroah-Hartman
@ 2013-12-17 21:17 ` Kees Cook
2013-12-17 21:54 ` Greg Kroah-Hartman
0 siblings, 1 reply; 7+ messages in thread
From: Kees Cook @ 2013-12-17 21:17 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: LKML, Bradley Grove, James E.J. Bottomley, linux-scsi
On Tue, Dec 17, 2013 at 12:00 PM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> On Tue, Dec 17, 2013 at 10:27:33AM -0800, Kees Cook wrote:
>> This makes sure format strings cannot leak into the printk call via the
>> constructed buffer.
>>
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>> ---
>> drivers/scsi/esas2r/esas2r_log.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> Why is this patch "To:" me? I'm not the author of this driver, or the
> maintainer of it or the subsystem, and there's not much, if anything I
> can do with it...
I've resent this before, and since it lived in "drivers", I figured
you would be the next up the chain to take it (since it's been
ignored).
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RESEND][PATCH] scsi: esas2r: fix potential format string flaw
2013-12-17 18:27 [RESEND][PATCH] scsi: esas2r: fix potential format string flaw Kees Cook
2013-12-17 20:00 ` Greg Kroah-Hartman
@ 2013-12-17 21:45 ` Bradley Grove
2013-12-18 5:42 ` Joe Perches
2 siblings, 0 replies; 7+ messages in thread
From: Bradley Grove @ 2013-12-17 21:45 UTC (permalink / raw)
To: Kees Cook, James E.J. Bottomley
Cc: Greg Kroah-Hartman, linux-kernel, Bradley Grove, linux-scsi
Acked-by: Bradley Grove <bgrove@attotech.com>
On 12/17/2013 01:27 PM, Kees Cook wrote:
> This makes sure format strings cannot leak into the printk call via the
> constructed buffer.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> drivers/scsi/esas2r/esas2r_log.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/esas2r/esas2r_log.c b/drivers/scsi/esas2r/esas2r_log.c
> index 9bf285df58dd..61fc19d296bd 100644
> --- a/drivers/scsi/esas2r/esas2r_log.c
> +++ b/drivers/scsi/esas2r/esas2r_log.c
> @@ -171,7 +171,7 @@ static int esas2r_log_master(const long level,
> if (strlen(event_buffer) < buflen)
> strcat(buffer, "\n");
>
> - printk(event_buffer);
> + printk("%s", event_buffer);
>
> spin_unlock_irqrestore(&event_buffer_lock, flags);
> }
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RESEND][PATCH] scsi: esas2r: fix potential format string flaw
2013-12-17 21:17 ` Kees Cook
@ 2013-12-17 21:54 ` Greg Kroah-Hartman
0 siblings, 0 replies; 7+ messages in thread
From: Greg Kroah-Hartman @ 2013-12-17 21:54 UTC (permalink / raw)
To: Kees Cook; +Cc: LKML, Bradley Grove, James E.J. Bottomley, linux-scsi
On Tue, Dec 17, 2013 at 01:17:51PM -0800, Kees Cook wrote:
> On Tue, Dec 17, 2013 at 12:00 PM, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> > On Tue, Dec 17, 2013 at 10:27:33AM -0800, Kees Cook wrote:
> >> This makes sure format strings cannot leak into the printk call via the
> >> constructed buffer.
> >>
> >> Signed-off-by: Kees Cook <keescook@chromium.org>
> >> ---
> >> drivers/scsi/esas2r/esas2r_log.c | 2 +-
> >> 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > Why is this patch "To:" me? I'm not the author of this driver, or the
> > maintainer of it or the subsystem, and there's not much, if anything I
> > can do with it...
>
> I've resent this before, and since it lived in "drivers", I figured
> you would be the next up the chain to take it (since it's been
> ignored).
Heh, while I do seem to maintain a ton of the drivers/ tree, I don't
take everything there. This needs to go through James's tree, he can
handle it :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RESEND][PATCH] scsi: esas2r: fix potential format string flaw
2013-12-17 18:27 [RESEND][PATCH] scsi: esas2r: fix potential format string flaw Kees Cook
2013-12-17 20:00 ` Greg Kroah-Hartman
2013-12-17 21:45 ` Bradley Grove
@ 2013-12-18 5:42 ` Joe Perches
2013-12-18 18:01 ` Kees Cook
2 siblings, 1 reply; 7+ messages in thread
From: Joe Perches @ 2013-12-18 5:42 UTC (permalink / raw)
To: Kees Cook
Cc: Greg Kroah-Hartman, linux-kernel, Bradley Grove,
James E.J. Bottomley, linux-scsi
On Tue, 2013-12-17 at 10:27 -0800, Kees Cook wrote:
> This makes sure format strings cannot leak into the printk call via the
> constructed buffer.
[]
> diff --git a/drivers/scsi/esas2r/esas2r_log.c b/drivers/scsi/esas2r/esas2r_log.c
[]
> @@ -171,7 +171,7 @@ static int esas2r_log_master(const long level,
> if (strlen(event_buffer) < buflen)
> strcat(buffer, "\n");
>
> - printk(event_buffer);
> + printk("%s", event_buffer);
It's probably better to remove the
if (strlen(event_buffer) < buflen)
strcat(buffer, "\n");
and use
printk("%s\n", event_buffer);
so that the output is always newline terminated.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RESEND][PATCH] scsi: esas2r: fix potential format string flaw
2013-12-18 5:42 ` Joe Perches
@ 2013-12-18 18:01 ` Kees Cook
0 siblings, 0 replies; 7+ messages in thread
From: Kees Cook @ 2013-12-18 18:01 UTC (permalink / raw)
To: Joe Perches
Cc: Greg Kroah-Hartman, LKML, Bradley Grove, James E.J. Bottomley,
linux-scsi
On Tue, Dec 17, 2013 at 9:42 PM, Joe Perches <joe@perches.com> wrote:
> On Tue, 2013-12-17 at 10:27 -0800, Kees Cook wrote:
>> This makes sure format strings cannot leak into the printk call via the
>> constructed buffer.
> []
>> diff --git a/drivers/scsi/esas2r/esas2r_log.c b/drivers/scsi/esas2r/esas2r_log.c
> []
>> @@ -171,7 +171,7 @@ static int esas2r_log_master(const long level,
>> if (strlen(event_buffer) < buflen)
>> strcat(buffer, "\n");
>>
>> - printk(event_buffer);
>> + printk("%s", event_buffer);
>
> It's probably better to remove the
>
> if (strlen(event_buffer) < buflen)
> strcat(buffer, "\n");
>
> and use
>
> printk("%s\n", event_buffer);
>
> so that the output is always newline terminated.
Ah! Yes, good call.
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2013-12-18 18:01 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-17 18:27 [RESEND][PATCH] scsi: esas2r: fix potential format string flaw Kees Cook
2013-12-17 20:00 ` Greg Kroah-Hartman
2013-12-17 21:17 ` Kees Cook
2013-12-17 21:54 ` Greg Kroah-Hartman
2013-12-17 21:45 ` Bradley Grove
2013-12-18 5:42 ` Joe Perches
2013-12-18 18:01 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).