From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sg-3-28.ptr.tlmpb.com (sg-3-28.ptr.tlmpb.com [101.45.255.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF09137C90B for ; Wed, 22 Apr 2026 17:40:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=101.45.255.28 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776879630; cv=none; b=BMWvhJo1Rv8JN640LAttIqnzqDqqsaYsTXe7BRykFwEmVhA5z9U3PuF9WeUN+tN944M609HP/MCYjC5wmlEwsk5+Lk2fusqLuKa7Pp+CyrZxbcjHGPyzsHJYMwyD7esD97CEp1/627Xz3s+GE0CWGTk8rs4C8WDfv2wSy6Bd390= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776879630; c=relaxed/simple; bh=nw7vvQ0tvlKPUJdesL3oT8dkaIF+elNDwcxu/QpJ87M=; h=To:Subject:Cc:Mime-Version:Date:From:Message-Id:Content-Type; b=mTu+jVMluMPJ0gC8UrlWZXMTFvvE/AOAbprEZKIF24ln41Nb+SowJtix1I8X/qUBgBDt0fbGUom0NesRp1ZOse96+vnKsFT2BnOZR5K281rS2p6siI0lyN/dveZBbIIdT2Nf65iEcTTdE/+803kRHSZp+bFh9lmTtPcIt/69pbk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b=VjNHg5eN; arc=none smtp.client-ip=101.45.255.28 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b="VjNHg5eN" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1776879578; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=qs9GUd9BD+oZzLK/vsuOICM6KBilsRgKUVepBg7QJJ4=; b=VjNHg5eN6T0G/5JprjMthUuKi6Uyguf47P3dOu7gMc0GL5B3dzqKUNRmsT6ouj6DLhtwSR chUfZKWJ/IGtbBCHYuESa69k98+Kn8Sxy6L9VvfSZh3zcVPhWKSjh4WhycxSXOxrrdn3x+ NkciWOyQtzvOtQR0VF+8m0sI59dNnH+kd65LJkRocsaxAyxyvSqyZhYjUTissFE9I6/cCb w51spGerxQsO3Y8SPdIBxWMXStI7yT7D+6EmbomH4fxSTw/6HvRVdWGlyL9EMu2j0lQnSa mEqXHPStFnpC4NzSLnktt0WuZ9CsFCWiXHpaPPrIh/Y246NngI2HYVlWLLyiaA== To: "Richard Weinberger" , "Anton Ivanov" , "Johannes Berg" , "Dan Carpenter" , "Andrew Morton" , "Jeff Dike" Subject: [PATCH] um: proc/exitcode: fix simple_strtol() out-of-bounds read X-Original-From: Shengzhuo Wei X-Lms-Return-Path: Cc: , , "Shengzhuo Wei" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Date: Thu, 23 Apr 2026 01:39:25 +0800 X-Change-Id: 20260423-fix_exitcode-908061ece624 X-Mailer: b4 0.14.2 Content-Transfer-Encoding: 7bit Received: from pve.cherr ([111.42.148.201]) by smtp.feishu.cn with ESMTPS; Thu, 23 Apr 2026 01:39:35 +0800 From: "Shengzhuo Wei" Message-Id: <20260423-fix_exitcode-v1-1-7e4508913d68@cherr.cc> X-B4-Tracking: v=1; b=H4sIAMwH6WkC/x2MQQqAIBQFrxJ/naAWUl0lIsJe9TcaGiGId09aD sNMpojAiDQ1mQJejuxdBdU2ZK/NnRC8VyYttZG97sTBaUXix/odYpSDNAoWRvdUkzug+n83L6V 8yBJH+F4AAAA= Content-Type: text/plain; charset=UTF-8 The stack buffer 'buf' is declared as char[sizeof("nnnnn\0")] (7 bytes) and the copy size is min(count, sizeof(buf)). When a user writes 7 or more bytes, copy_from_user fills all 7 bytes without a NUL terminator. The subsequent call to simple_strtol() expects a NUL-terminated string and will read past the end of buf on the stack. write(2) should report the number of bytes consumed. Returning the original count would claim success even when the input was truncated, so userspace cannot detect it. Clamp the copy length to sizeof(buf)-1, add a terminator, and return the consumed length. Fixes: 201f99f170df ("uml: check length in exitcode_proc_write()") Fixes: e16f5350d4cf ("uml: get declaration of simple_strtoul") Signed-off-by: Shengzhuo Wei --- arch/um/kernel/exitcode.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/um/kernel/exitcode.c b/arch/um/kernel/exitcode.c index 43edc2aa57e4fbd4a3d24f96878c76f9f8fd4eaa..8de404ff21a213918c5351bc20a6e047bf1b93f5 100644 --- a/arch/um/kernel/exitcode.c +++ b/arch/um/kernel/exitcode.c @@ -43,16 +43,17 @@ static ssize_t exitcode_proc_write(struct file *file, size_t size; int tmp; - size = min(count, sizeof(buf)); + size = min(count, sizeof(buf) - 1); if (copy_from_user(buf, buffer, size)) return -EFAULT; + buf[size] = '\0'; tmp = simple_strtol(buf, &end, 0); if ((*end != '\0') && !isspace(*end)) return -EINVAL; uml_exitcode = tmp; - return count; + return size; } static const struct proc_ops exitcode_proc_ops = { --- base-commit: 6596a02b207886e9e00bb0161c7fd59fea53c081 change-id: 20260423-fix_exitcode-908061ece624 Best regards, -- Shengzhuo Wei