From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9E54DC04A94 for ; Mon, 14 Aug 2023 10:43:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229460AbjHNKnU convert rfc822-to-8bit (ORCPT ); Mon, 14 Aug 2023 06:43:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54692 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235456AbjHNKmn (ORCPT ); Mon, 14 Aug 2023 06:42:43 -0400 Received: from eu-smtp-delivery-151.mimecast.com (eu-smtp-delivery-151.mimecast.com [185.58.85.151]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D5F7D1704 for ; Mon, 14 Aug 2023 03:42:40 -0700 (PDT) Received: from AcuMS.aculab.com (156.67.243.121 [156.67.243.121]) by relay.mimecast.com with ESMTP with both STARTTLS and AUTH (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id uk-mta-10-bYN0va-pOwmudf1yAI4-aA-1; Mon, 14 Aug 2023 11:42:38 +0100 X-MC-Unique: bYN0va-pOwmudf1yAI4-aA-1 Received: from AcuMS.Aculab.com (10.202.163.4) by AcuMS.aculab.com (10.202.163.4) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Mon, 14 Aug 2023 11:42:26 +0100 Received: from AcuMS.Aculab.com ([::1]) by AcuMS.aculab.com ([::1]) with mapi id 15.00.1497.048; Mon, 14 Aug 2023 11:42:26 +0100 From: David Laight To: 'Kees Cook' , Petr Mladek CC: Sergey Senozhatsky , Steven Rostedt , John Ogness , "Vijay Balakrishna" , "stable@vger.kernel.org" , Tony Luck , "Guilherme G. Piccoli" , "Paul E. McKenney" , "linux-kernel@vger.kernel.org" , "linux-hardening@vger.kernel.org" Subject: RE: [PATCH] printk: ringbuffer: Fix truncating buffer size min_t cast Thread-Topic: [PATCH] printk: ringbuffer: Fix truncating buffer size min_t cast Thread-Index: AQHZzBcPYpG1g1kNlkm6DrLi5BIXA6/pnsfQ Date: Mon, 14 Aug 2023 10:42:26 +0000 Message-ID: <42a1e2099fe141c3a57e808cbf06d8a0@AcuMS.aculab.com> References: <20230811054528.never.165-kees@kernel.org> In-Reply-To: <20230811054528.never.165-kees@kernel.org> Accept-Language: en-GB, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.202.205.107] MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: aculab.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kees Cook > Sent: 11 August 2023 06:46 > > If an output buffer size exceeded U16_MAX, the min_t(u16, ...) cast in > copy_data() was causing writes to truncate. This manifested as output > bytes being skipped, seen as %NUL bytes in pstore dumps when the available > record size was larger than 65536. Fix the cast to no longer truncate > the calculation. > ... > diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c > index 2dc4d5a1f1ff..fde338606ce8 100644 > --- a/kernel/printk/printk_ringbuffer.c > +++ b/kernel/printk/printk_ringbuffer.c > @@ -1735,7 +1735,7 @@ static bool copy_data(struct prb_data_ring *data_ring, > if (!buf || !buf_size) > return true; > > - data_size = min_t(u16, buf_size, len); > + data_size = min_t(unsigned int, buf_size, len); I'd noticed that during one of my test compiles while looking at making min() less fussy. A better fix would be: data_size = min(buf_size + 0u, len); Or put an ack on my patch 3/5 to minmax.h and then min(buf_size, len) will be fine (because both arguments are unsigned). David > > memcpy(&buf[0], data, data_size); /* LMM(copy_data:A) */ > return true; > -- > 2.34.1 - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)