linux-kernel - Re: [PATCH] kdb: Fix a potential buffer overflow in kdb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAD=FV=WSh7wKN7Yp-3wWiDgX4E3isQ8uh0LCzTmd1v9Cg9j+nQ@mail.gmail.com>
Date:   Mon, 30 Oct 2023 09:36:16 -0700
From:   Doug Anderson <dianders@...omium.org>
To:     Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc:     Jason Wessel <jason.wessel@...driver.com>,
        Daniel Thompson <daniel.thompson@...aro.org>,
        Martin Hicks <mort@....com>, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org,
        kgdb-bugreport@...ts.sourceforge.net
Subject: Re: [PATCH] kdb: Fix a potential buffer overflow in kdb_local()

Hi,

On Sat, Oct 28, 2023 at 6:55 AM Christophe JAILLET
<christophe.jaillet@...adoo.fr> wrote:
>
> When appending "[defcmd]" to 'kdb_prompt_str', the size of the string
> already in the buffer should be taken into account.
>
> Switch from strncat() to strlcat() which does the correct test to avoid
> such an overflow.
>
> Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
> ---
>  kernel/debug/kdb/kdb_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
> index 438b868cbfa9..e5f0bf0f45d1 100644
> --- a/kernel/debug/kdb/kdb_main.c
> +++ b/kernel/debug/kdb/kdb_main.c
> @@ -1350,7 +1350,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
>                 snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"),
>                          raw_smp_processor_id());
>                 if (defcmd_in_progress)
> -                       strncat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN);
> +                       strlcat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN);

Some of this code is a bit hard to follow, but I think it's better to
simply delete the whole "strncat". Specifically, as of commit
a37372f6c3c0 ("kdb: Prevent kernel oops with kdb_defcmd") it's clear
that "defcmd" can't actually be run to define new commands
interactively. It's also clear to me that "defcmd_in_progress" is only
set when defining new commands.

The prompt being constructed here is a prompt that's printed to the
end user when working interactively. That means the "if
(defcmd_in_progress)" should never be true and it can be deleted as
dead code.

-Doug