From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 21630139CFE; Thu, 13 Jun 2024 12:27:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718281642; cv=none; b=dDCyj/4C1QJfD2srzTMJf7k1t0weH8dwIOzAUhH1Vq/jgk+w1Uq1XL8AEof+UzEYJlWpFMayuxbyKm0RDWZ3sOYO4/ZPOSEXXHM9eV1dVOh4LcJAPFM9ruDwCnPhK+j2FUDITdfXTp1Ln2I3+vOkdpOsQlxAVkz44ylxa2mEQOk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718281642; c=relaxed/simple; bh=z9WctTdty11AgF1tCI+Nt0cHxLE4W/sORB0k5hh+ZHQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FGrH5wCYZxBG6r5rT1+h29vOxx5cgpKRRyFqv8FNeAjhaRjLs2mN9xK9Ga2pQOX9p+CcPHzRk7klhiKm6C+HeQ4RBlP2qzb0dq0qWkW/HFU4FRLvvppdqFnKZC/C4r8xZJY2OnjLuZWjHapJDS8KctLsT/3yc6j4wBnD/08KNcA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UPgaOttT; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="UPgaOttT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9BF9AC2BBFC; Thu, 13 Jun 2024 12:27:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1718281642; bh=z9WctTdty11AgF1tCI+Nt0cHxLE4W/sORB0k5hh+ZHQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UPgaOttTpsuIflsxGRc2ELi5XtEQ4oreBYHMtIe3NGeI5DAmtfnpnhtNrVIjIt3Bi DsNguE5EFwnvLf18QX2z2Z726379WewrmM/+FCGaJLOHlbs5IuOlGep/6mzGDzzA6w xnDMykL4Gloc/7So0NmIxwJOfYXtaGc4HRBLYg1E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Justin Stitt , Douglas Anderson , Daniel Thompson Subject: [PATCH 5.10 303/317] kdb: Fix buffer overflow during tab-complete Date: Thu, 13 Jun 2024 13:35:21 +0200 Message-ID: <20240613113259.272569995@linuxfoundation.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240613113247.525431100@linuxfoundation.org> References: <20240613113247.525431100@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel Thompson commit e9730744bf3af04cda23799029342aa3cddbc454 upstream. Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around. Reported-by: Justin Stitt Closes: https://lore.kernel.org/all/CAFhGd8qESuuifuHsNjFPR-Va3P80bxrw+LqvC8deA8GziUJLpw@mail.gmail.com/ Cc: stable@vger.kernel.org Reviewed-by: Douglas Anderson Reviewed-by: Justin Stitt Tested-by: Justin Stitt Link: https://lore.kernel.org/r/20240424-kgdb_read_refactor-v3-1-f236dbe9828d@linaro.org Signed-off-by: Daniel Thompson Signed-off-by: Greg Kroah-Hartman --- kernel/debug/kdb/kdb_io.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) --- a/kernel/debug/kdb/kdb_io.c +++ b/kernel/debug/kdb/kdb_io.c @@ -354,14 +354,19 @@ poll_again: kdb_printf(kdb_prompt_str); kdb_printf("%s", buffer); } else if (tab != 2 && count > 0) { - len_tmp = strlen(p_tmp); - strncpy(p_tmp+len_tmp, cp, lastchar-cp+1); - len_tmp = strlen(p_tmp); - strncpy(cp, p_tmp+len, len_tmp-len + 1); - len = len_tmp - len; - kdb_printf("%s", cp); - cp += len; - lastchar += len; + /* How many new characters do we want from tmpbuffer? */ + len_tmp = strlen(p_tmp) - len; + if (lastchar + len_tmp >= bufend) + len_tmp = bufend - lastchar; + + if (len_tmp) { + /* + 1 ensures the '\0' is memmove'd */ + memmove(cp+len_tmp, cp, (lastchar-cp) + 1); + memcpy(cp, p_tmp+len, len_tmp); + kdb_printf("%s", cp); + cp += len_tmp; + lastchar += len_tmp; + } } kdb_nextline = 1; /* reset output line number */ break;