From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A0DC145FE0; Thu, 13 Jun 2024 11:52:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718279531; cv=none; b=JpOXi5XKN3eGSm/9755ClmZPS4wg6p4s1AJM3buO/ece+ZO/Bz3H4iB1wFIvYX+V/5sajxCx5RTbwmLAs38i7plF2LFhzQpkm3/B2E57EZ4BupMXmOBFQSz/OyJjbcMOqunekNq5AUKp1qGym0tJdzsFm+bS890PlGukdaq0BBU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718279531; c=relaxed/simple; bh=G8MhzWhq8sZ2I14TGrlhbzUVM2Twep3swcmpPS6slDM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WEE2eglV0Apf3o13zJUJ2peX61sC00kr3jhuWkiAvO6vSdYNeNaSeu0ZhXhJA03RJ9f49jcIXMXcAPffCusyz3lL8GU5dmw8demhzz5+eZYCaiMbuHp7+4DF4U9QTq39hvJ0CTorQ9bm13kyU2oTJ6MLRYcS06L2e6Wddp/U7IA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rHnv1fnv; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="rHnv1fnv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 003F3C4AF1A; Thu, 13 Jun 2024 11:52:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1718279531; bh=G8MhzWhq8sZ2I14TGrlhbzUVM2Twep3swcmpPS6slDM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rHnv1fnvA1BpAkxsrydneHEIAuDiErhG9eglC7XSfERtQlA2/ntE3sTJ5DiY3Au7Z aYu/OnABh6UeO3Tr+znXmeEk9WDQ2wfTfW87HqQqhC7XwP2QjZnlrY09zuFWfmRdxX h+oPk9gLF8EldeNvjPiGrF+9WAoXivqdEyuB/qgU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Justin Stitt , Douglas Anderson , Daniel Thompson Subject: [PATCH 6.9 108/157] kdb: Fix buffer overflow during tab-complete Date: Thu, 13 Jun 2024 13:33:53 +0200 Message-ID: <20240613113231.595757245@linuxfoundation.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240613113227.389465891@linuxfoundation.org> References: <20240613113227.389465891@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel Thompson commit e9730744bf3af04cda23799029342aa3cddbc454 upstream. Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around. Reported-by: Justin Stitt Closes: https://lore.kernel.org/all/CAFhGd8qESuuifuHsNjFPR-Va3P80bxrw+LqvC8deA8GziUJLpw@mail.gmail.com/ Cc: stable@vger.kernel.org Reviewed-by: Douglas Anderson Reviewed-by: Justin Stitt Tested-by: Justin Stitt Link: https://lore.kernel.org/r/20240424-kgdb_read_refactor-v3-1-f236dbe9828d@linaro.org Signed-off-by: Daniel Thompson Signed-off-by: Greg Kroah-Hartman --- kernel/debug/kdb/kdb_io.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) --- a/kernel/debug/kdb/kdb_io.c +++ b/kernel/debug/kdb/kdb_io.c @@ -367,14 +367,19 @@ poll_again: kdb_printf(kdb_prompt_str); kdb_printf("%s", buffer); } else if (tab != 2 && count > 0) { - len_tmp = strlen(p_tmp); - strncpy(p_tmp+len_tmp, cp, lastchar-cp+1); - len_tmp = strlen(p_tmp); - strncpy(cp, p_tmp+len, len_tmp-len + 1); - len = len_tmp - len; - kdb_printf("%s", cp); - cp += len; - lastchar += len; + /* How many new characters do we want from tmpbuffer? */ + len_tmp = strlen(p_tmp) - len; + if (lastchar + len_tmp >= bufend) + len_tmp = bufend - lastchar; + + if (len_tmp) { + /* + 1 ensures the '\0' is memmove'd */ + memmove(cp+len_tmp, cp, (lastchar-cp) + 1); + memcpy(cp, p_tmp+len, len_tmp); + kdb_printf("%s", cp); + cp += len_tmp; + lastchar += len_tmp; + } } kdb_nextline = 1; /* reset output line number */ break;