From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAEE0C001DE for ; Fri, 11 Aug 2023 16:53:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231511AbjHKQxx (ORCPT ); Fri, 11 Aug 2023 12:53:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42430 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231928AbjHKQxx (ORCPT ); Fri, 11 Aug 2023 12:53:53 -0400 Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D2D5130C1; Fri, 11 Aug 2023 09:53:52 -0700 (PDT) Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.west.internal (Postfix) with ESMTP id 5EDDE32001FF; Fri, 11 Aug 2023 12:53:51 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute5.internal (MEProxy); Fri, 11 Aug 2023 12:53:52 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tyhicks.com; h= cc:cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:sender :subject:subject:to:to; s=fm3; t=1691772830; x=1691859230; bh=W3 QlfQPf/mhvsUrrEpuciPnw8YcCrut43G8ZIaPlOQ0=; b=rq1RlGScfenEom/BZ5 mh5DqdQFANtcENVmz1ZAe1+woYnjJlXGpi4QGvKSHV0CdWGUTvpf2StJsjr4qQDy ZrA/NUhULu2Pr4fvOMPXieFrjfhN+wtCI3JvX7lPKvgT4Fyp7/Y8ijDSgiC9cY1W sIBituV1M9VDfjLYRPUasZS/WNnCgZaDQRaV3aoepfvkowsjAtlZDScm44hXjnwR XEtkzlQCH06mPWtAa3xo0QkzKS+H6DLZbDF6FjbF1oiJU+tIIfvZF29oZhIsLjzz NGjLfr5EVh5r4oprdx9iWm6R+09s6yrIqc8vI7Ao+v1aM2PDSj+9lo949lZYFA7m UUPw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; t=1691772830; x=1691859230; bh=W3QlfQPf/mhvs UrrEpuciPnw8YcCrut43G8ZIaPlOQ0=; b=qmNm5DWVpIG9SgcAJYhVSgVOFi0gJ ShmFThzYAQY2nerhQPStN4DEK9Klef2gV7qOhe8pZIbMZmAEDKMFPp65BWW+TwqA lmay1DrejRorvFGPP1jnFpCPkfGdjfhc8H9ZpJS3YKpUOtW7FIwJpEjoPKrVudV8 fwNizWihX07PcLVxEdFwOrzOzSfgpCXiBFdpNwhL6Hhq9A8EGgH+VH+DAauyM3gY jhqeiNzKqzzVqd0OpJ3yrDU+BbH66hZsywDIoJ++o35KJ8nVS5g+JIAK8fL+avVK tlm9IybVbnmo+y3mWvZc/VyPK8+kkDzyoZDv5Kv2gWbtd8EQESc70+4EA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrleekgddutdehucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepfffhvfevuffkfhggtggujgesthdtredttddtvdenucfhrhhomhepvfihlhgv rhcujfhitghkshcuoegtohguvgesthihhhhitghkshdrtghomheqnecuggftrfgrthhtvg hrnhepgfegkeeiffethefgteffudfhfeejhedvjefhjeekudelffdulefhfeekieeludej necuffhomhgrihhnpehkvghrnhgvlhdrohhrghenucevlhhushhtvghrufhiiigvpedtne curfgrrhgrmhepmhgrihhlfhhrohhmpegtohguvgesthihhhhitghkshdrtghomh X-ME-Proxy: Feedback-ID: i78e14604:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 11 Aug 2023 12:53:48 -0400 (EDT) Date: Fri, 11 Aug 2023 11:53:37 -0500 From: Tyler Hicks To: Kees Cook Cc: Petr Mladek , Sergey Senozhatsky , Steven Rostedt , John Ogness , Vijay Balakrishna , stable@vger.kernel.org, Tony Luck , "Guilherme G. Piccoli" , "Paul E. McKenney" , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH] printk: ringbuffer: Fix truncating buffer size min_t cast Message-ID: References: <20230811054528.never.165-kees@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230811054528.never.165-kees@kernel.org> Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On 2023-08-10 22:45:32, Kees Cook wrote: > If an output buffer size exceeded U16_MAX, the min_t(u16, ...) cast in > copy_data() was causing writes to truncate. This manifested as output > bytes being skipped, seen as %NUL bytes in pstore dumps when the available > record size was larger than 65536. Fix the cast to no longer truncate > the calculation. > > Cc: Petr Mladek > Cc: Sergey Senozhatsky > Cc: Steven Rostedt > Cc: John Ogness > Reported-by: Vijay Balakrishna > Closes: https://lore.kernel.org/lkml/d8bb1ec7-a4c5-43a2-9de0-9643a70b899f@linux.microsoft.com/ > Fixes: b6cf8b3f3312 ("printk: add lockless ringbuffer") > Cc: stable@vger.kernel.org > Signed-off-by: Kees Cook Nice find! Reviewed-by: Tyler Hicks (Microsoft) Tested-by: Tyler Hicks (Microsoft) Verified the fix by applying it to an instrumented v6.5-rc5 kernel that allows userspace to execute kmsg_dump(), detects NULL bytes in data copied from the ring buffer, and warns about invalid truncation due to the min_t(u16, ...) casting bug. Everything looks good! Tyler > --- > kernel/printk/printk_ringbuffer.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c > index 2dc4d5a1f1ff..fde338606ce8 100644 > --- a/kernel/printk/printk_ringbuffer.c > +++ b/kernel/printk/printk_ringbuffer.c > @@ -1735,7 +1735,7 @@ static bool copy_data(struct prb_data_ring *data_ring, > if (!buf || !buf_size) > return true; > > - data_size = min_t(u16, buf_size, len); > + data_size = min_t(unsigned int, buf_size, len); > > memcpy(&buf[0], data, data_size); /* LMM(copy_data:A) */ > return true; > -- > 2.34.1 >