linux-kernel - Re: [PATCH] blk-throttle: Fix some potential string truncation in tg_prfill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZYSxUPan9qPNE5Bk@mtj.duckdns.org>
Date: Fri, 22 Dec 2023 06:42:40 +0900
From: Tejun Heo <tj@...nel.org>
To: Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc: Josef Bacik <josef@...icpanda.com>, Jens Axboe <axboe@...nel.dk>,
	Shaohua Li <shli@...com>, linux-kernel@...r.kernel.org,
	kernel-janitors@...r.kernel.org, cgroups@...r.kernel.org,
	linux-block@...r.kernel.org
Subject: Re: [PATCH] blk-throttle: Fix some potential string truncation in
 tg_prfill_limit()

On Sat, Dec 16, 2023 at 01:54:56PM +0100, Christophe JAILLET wrote:
> When compiled with W=1, we get:
>   block/blk-throttle.c: In function ‘tg_prfill_limit’:
>   block/blk-throttle.c:1539:74: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
>    1539 |                         snprintf(idle_time, sizeof(idle_time), " idle=%lu",
>         |                                                                          ^
>   block/blk-throttle.c:1539:25: note: ‘snprintf’ output between 8 and 27 bytes into a destination of size 26
>    1539 |                         snprintf(idle_time, sizeof(idle_time), " idle=%lu",
>         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>    1540 |                                 tg->idletime_threshold_conf);
>         |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>   block/blk-throttle.c:1546:43: error: ‘%lu’ directive output may be truncated writing between 1 and 20 bytes into a region of size 17 [-Werror=format-truncation=]
>    1546 |                                 " latency=%lu", tg->latency_target_conf);
>         |                                           ^~~
>   block/blk-throttle.c:1546:33: note: directive argument in the range [0, 18446744073709551614]
>    1546 |                                 " latency=%lu", tg->latency_target_conf);
>         |                                 ^~~~~~~~~~~~~~
>   block/blk-throttle.c:1545:25: note: ‘snprintf’ output between 11 and 30 bytes into a destination of size 26
>    1545 |                         snprintf(latency_time, sizeof(latency_time),
>         |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>    1546 |                                 " latency=%lu", tg->latency_target_conf);
>         |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> In order to fix it, remove all the intermediate buffers and write directly
> into the 'sf' seq_file.
> 
> Fixes: ada75b6e5b2a ("blk-throttle: add interface to configure idle time threshold")
> Fixes: ec80991d6fc2 ("blk-throttle: add interface for per-cgroup target latency")

I'm not sure Fixes tags are necessary here given that this isn't something
we'd hit in practice.

> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>

Looks fine to me, so:

  Acked-by: Tejun Heo <tj@...nel.org>

But, can you please briefly explain how you tested the patch?

Thanks.

-- 
tejun