From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38B43346E46 for ; Thu, 14 May 2026 17:44:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778780644; cv=none; b=PwmacKJG2tPQEfI2CXZgFGx9CB9K14rXtoCKZ1CuIeB+5GRtENe33nqjXy2H4vAgE9UGaY6e4xCPiWJX4EwuL6vfvAQoS4ASC8jy/6gnmUyU3pFfd57LTlSZbBmGyzsQq4doRMLwEjUF4bBD9jt8QvtBkCdkIt/OHtSHfBrJuNw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778780644; c=relaxed/simple; bh=yowZezkBBgskMLosGJiG0SiaeuIzu2KjKFSMLHA5Hss=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=n2HqQKh8nAJoPH7+pQFNEURqlTjslXHRic+bajuzFEAa1xKPlJy7zSMAfz3sbOpuLsWBwObGF6iRggHb7b3rFr4j1AObGBZHHP8ajQtEbNbOwF18h9jlJUkMqzKGJQzDM5ct3XovEvrVNCs0JSRbwUMXOku66wdPGgA2XLCaZos= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=V5Z8ZGBs; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="V5Z8ZGBs" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-48e69e60063so7043455e9.1 for ; Thu, 14 May 2026 10:44:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778780641; x=1779385441; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=bSkQwjSClU3t6n5qA8FNKqSsPFaEwqM8tCQVsiA4MwE=; b=V5Z8ZGBsRIdj/uh+bgOC+GH75yPyHL9NXpm7xKpYPAbqvIo3kLWfaxZpEBBNz6NFUG pTwznWVmhuHQWzbnBkCcrjTRGNY1Skv7FvbmjMgW9hvv22c4QmrqaL4AST5NAuN3yM97 tqdgJXlB52iOqcLrCDMouq2DCYQkZTWDrEtuyaNQwkJh1Jhk0qkEl1gPod1knzb0qRmS 5KN4ENacfXHzhO1fFSG/VIMwIcv++Az73v84RID2lrGXN2Rv5NwUYxL4t5ZPxZ4EFsU/ IcZ1Ac4jHmBu5BnLpY/O+dIICgfmHDO69IUlHPoKbxSGpcvX1Nzy6BAo1zqgz0PHY52l /90g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778780641; x=1779385441; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=bSkQwjSClU3t6n5qA8FNKqSsPFaEwqM8tCQVsiA4MwE=; b=de2MBDLwnvYgz9qsRLYVTAv493ck9FNO5kgos7aRhgMx5M6zkT67joy7MmHg1ccIgR jFJG6tkFv+SDBgDOe+SctKls7IyWpsTNe1VELexyaPZI8YkoEa7MiG6hMIYvkkGMVXwq vD2+J+XQ8mgFMdmvXn9X1kbh+OYf6u0whcbbJP9z2DMTAgnMWRIV+SZKx+b/XDkPzL4Q 4nJfE0KHoPmc9CCraXQ1fgx63GgPS9Dx2STS89qPRqc83t7siknuzC2L2CkXvZx8nmDs /l28ylPjSoC2SR0nk8k3lo8moC383lN3HzoW7E56aC+yqlXyk75kUfpAODWZN5+cLnFk dA3g== X-Forwarded-Encrypted: i=1; AFNElJ+zDtswIHwdzMAy10g2uWKElZiWvJmrmgKESLnL1kqUCSA3atNYKMIzv2q1Uv8I3heH3Ffj49JguH5j1Bw=@vger.kernel.org X-Gm-Message-State: AOJu0YxTlQnYKBaSbRrYeUpsOWxRS1CcafLj4jk/zzhAPd5YoPT3ybvL 93UJVpolK2lVip5gaAI6VgMt8/O47W2jZfPUNgRhxcYowKy3CANs1An+ X-Gm-Gg: Acq92OH/y+RIX/lG+WjxJy2K5XSlYK1XxYAmQvVfUjTTFYftaG2e2TyaozFNzeZMJNb Wvvrmb4H2iXcoD8xFrKtEnE1JlTxdX1MxWVbvMD3xesxAKHpHiPPWxTlNLAsg7iZ/plvHUN3ca3 TAh7AIsEEa/d0T8qemEpYHEH1gM8/VsCmjwvp1MWACMrDA2ppoCI9fJ/ALGlb3pR3vLvSne0z/A 4Y11AzB4BdBCAYVxXHOQq9MoLddTurMScihIBkSvFNcb36HHx3xJhmQPNFrhIiA4Efe8kM90EEh olj4keC/L4rgmTnPvNl3tifHas8usyQfdhFw3QMvYwPezDR+kUYvQwoKkNq6FXOOVNKt/Z/V33Q vH+V8AMFBEwZZKqW+tdfZixwoy79im38yoI2XTdLAzlLcNHIzSozz2jgs5BP4mkkkw4p4as1Pt/ +NE9jmL0Wgvj44273oliC24LpFlNEcrBf5NOfVwr9AAB/h X-Received: by 2002:a05:600c:a48:b0:48f:c8d4:487a with SMTP id 5b1f17b1804b1-48fe63138d7mr2814385e9.8.1778780640606; Thu, 14 May 2026 10:44:00 -0700 (PDT) Received: from localhost.localdomain ([82.215.118.79]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48fd76822d6sm22249125e9.26.2026.05.14.10.43.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 May 2026 10:44:00 -0700 (PDT) From: Stepan Ionichev To: andy@kernel.org Cc: geert@linux-m68k.org, hcazarim@yahoo.com, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, sozdayvek@gmail.com Subject: [PATCH] auxdisplay: line-display: fix OOB read on zero-length message_store() Date: Thu, 14 May 2026 22:43:42 +0500 Message-Id: <20260514174342.28451-1-sozdayvek@gmail.com> X-Mailer: git-send-email 2.33.0.windows.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit linedisp_display() unconditionally reads msg[count - 1] before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg[-1]: write(fd, "", 0); -> message_store(..., buf, count=0) -> linedisp_display(linedisp, buf, count=0) -> msg[count - 1] == '\n' ; OOB read The kernfs write buffer for that store is a 1-byte allocation (kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0), so msg[-1] is a 1-byte read before the slab object. On a KASAN-enabled kernel this trips an out-of-bounds report and panics; on stock kernels it silently reads adjacent slab data and, if that byte happens to be '\n', the following count-- wraps ssize_t 0 to -1 and is then passed to kmemdup_nul(). linedisp_display() is reached from the message_store() sysfs callback (drivers/auxdisplay/line-display.c message attribute, mode 0644) and from the in-tree initial-message setup with count == -1, so the OOB path is only userspace-triggerable via zero-byte writes; vfs_write() does not short-circuit on count == 0 and kernfs_fop_write_iter() dispatches the store callback regardless. Guard the trailing-newline trim with a count check. The existing if (!count) block then takes the clear-display path unchanged. Affects every auxdisplay driver that registers via linedisp_register() / linedisp_attach(): ht16k33, max6959, img-ascii-lcd, seg-led-gpio. Fixes: 7e76aece6f03 ("auxdisplay: Extract character line display core support") Signed-off-by: Stepan Ionichev --- drivers/auxdisplay/line-display.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/auxdisplay/line-display.c b/drivers/auxdisplay/line-display.c index fb6d92941..915eb5cd9 100644 --- a/drivers/auxdisplay/line-display.c +++ b/drivers/auxdisplay/line-display.c @@ -173,7 +173,7 @@ static int linedisp_display(struct linedisp *linedisp, const char *msg, count = strlen(msg); /* if the string ends with a newline, trim it */ - if (msg[count - 1] == '\n') + if (count && msg[count - 1] == '\n') count--; if (!count) { -- 2.43.0