linux-kernel - [RFC PATCH] kernel/panic: Filter out a potential trailing newline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181009205019.2786-1-bp@alien8.de>
Date:   Tue,  9 Oct 2018 22:50:19 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     LKML <linux-kernel@...r.kernel.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Kees Cook <keescook@...omium.org>,
        "Steven Rostedt (VMware)" <rostedt@...dmis.org>, x86@...nel.org
Subject: [RFC PATCH] kernel/panic: Filter out a potential trailing newline

From: Borislav Petkov <bp@...e.de>

If a call to panic() terminates the string with a \n, the result puts
the closing brace ']---' on a newline because panic() itself adds \n
too.

Now, if one goes and removes the newline chars from all panic()
invocations - and the stats right now look like this:

~300 calls with an \n
~500 calls without a \n

one is destined to a neverending game of whack-a-mole because the usual
thing to do is add a newline at the end of a string a function is
supposed to print.

Therefore, simply zap any \n at the end of the panic string to avoid
touching so many places in the kernel.

Signed-off-by: Borislav Petkov <bp@...e.de>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Kees Cook <keescook@...omium.org>
Cc: "Steven Rostedt (VMware)" <rostedt@...dmis.org>
Cc: x86@...nel.org
---
 kernel/panic.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/kernel/panic.c b/kernel/panic.c
index 8b2e002d52eb..5776d2879650 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -136,7 +136,7 @@ void panic(const char *fmt, ...)
 {
 	static char buf[1024];
 	va_list args;
-	long i, i_next = 0;
+	long i, i_next = 0, len;
 	int state = 0;
 	int old_cpu, this_cpu;
 	bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers;
@@ -173,8 +173,12 @@ void panic(const char *fmt, ...)
 	console_verbose();
 	bust_spinlocks(1);
 	va_start(args, fmt);
-	vsnprintf(buf, sizeof(buf), fmt, args);
+	len = vscnprintf(buf, sizeof(buf), fmt, args);
 	va_end(args);
+
+	if (len && buf[len - 1] == '\n')
+		buf[len - 1] = '\0';
+
 	pr_emerg("Kernel panic - not syncing: %s\n", buf);
 #ifdef CONFIG_DEBUG_BUGVERBOSE
 	/*
-- 
2.19.0.271.gfe8321ec057f