From: "Shengzhuo Wei" <me@cherr.cc>
To: "David Laight" <david.laight.linux@gmail.com>
Cc: "Richard Weinberger" <richard@nod.at>,
"Anton Ivanov" <anton.ivanov@cambridgegreys.com>,
"Johannes Berg" <johannes@sipsolutions.net>,
"Dan Carpenter" <error27@gmail.com>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Jeff Dike" <jdike@addtoit.com>, "Yao Zi" <me@ziyao.cc>,
<linux-um@lists.infradead.org>, <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] um: proc/exitcode: fix simple_strtol() out-of-bounds read
Date: Thu, 23 Apr 2026 11:28:45 +0800 [thread overview]
Message-ID: <aemR7Ur4H9dnKQ57@pve.cherr> (raw)
In-Reply-To: <20260422214507.0078c8ba@pumpkin>
On 2026-04-22 21:45, David Laight wrote:
> On Thu, 23 Apr 2026 01:39:25 +0800
> "Shengzhuo Wei" <me@cherr.cc> wrote:
>
> > The stack buffer 'buf' is declared as char[sizeof("nnnnn\0")] (7 bytes)
> > and the copy size is min(count, sizeof(buf)). When a user writes 7 or
> > more bytes, copy_from_user fills all 7 bytes without a NUL terminator.
> > The subsequent call to simple_strtol() expects a NUL-terminated string
> > and will read past the end of buf on the stack.
>
> You should probably also mention that write(, "123", 3) will lead to
> buf[3] being read - which is uninitialised stack.
>
> David
Thanks for the review, will fix in v2.
Best regards
next prev parent reply other threads:[~2026-04-23 3:29 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-22 17:39 [PATCH] um: proc/exitcode: fix simple_strtol() out-of-bounds read Shengzhuo Wei
2026-04-22 20:45 ` David Laight
2026-04-23 3:28 ` Shengzhuo Wei [this message]
2026-04-27 13:36 ` Shengzhuo Wei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aemR7Ur4H9dnKQ57@pve.cherr \
--to=me@cherr.cc \
--cc=akpm@linux-foundation.org \
--cc=anton.ivanov@cambridgegreys.com \
--cc=david.laight.linux@gmail.com \
--cc=error27@gmail.com \
--cc=jdike@addtoit.com \
--cc=johannes@sipsolutions.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-um@lists.infradead.org \
--cc=me@ziyao.cc \
--cc=richard@nod.at \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox