linux-kernel - Re: [GIT PULL] vsprintf: Fix off-by-one bug in bstr_printf() processing dereferenced pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 10 Oct 2018 22:34:55 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Nikolay Borisov <nborisov@...e.com>, stable@...r.kernel.org
Subject: Re: [GIT PULL] vsprintf: Fix off-by-one bug in bstr_printf()
 processing dereferenced pointers

On Wed, Oct 10, 2018 at 09:18:03AM -0400, Steven Rostedt wrote:
> 
> Linus (aka Greg),
> 
> It was reported that trace_printk() was not reporting properly
> values that came after a dereference pointer.
> 
> trace_printk() utilizes vbin_printf() and bstr_printf() to keep the
> overhead of tracing down. vbin_printf() does not do any conversions
> and just stors the string format and the raw arguments into the
> buffer. bstr_printf() is used to read the buffer and does the conversions
> to complete the printf() output.
> 
> This can be troublesome with dereferenced pointers because the reference
> may be different from the time vbin_printf() is called to the time
> bstr_printf() is called. To fix this, a prior commit changed vbin_printf()
> to convert dereferenced pointers into strings and load the converted
> string into the buffer. But the change to bstr_printf() had an off-by-one
> error and didn't account for the nul character at the end of the string
> and this corrupted the rest of the values in the format that came after
> a dereferenced pointer.
> 
> 
> Please pull the latest trace-v4.19-rc5 tree, which can be found at:
> 
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
> trace-v4.19-rc5
> 
> Tag SHA1: b5fc80d980ae316323e88c165084deef39afd168
> Head SHA1: 62165600ae73ebd76e2d9b992b36360408d570d8
> 

Now merged, thanks.

greg k-h