linux-kernel - [PATCH] sched/psi: Fix the bug where the last character is overwritten

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <a33440f33d42aab66ad4120303ecbe8dca401d5c.1705490349.git.escape@linux.alibaba.com>
Date: Wed, 17 Jan 2024 19:26:01 +0800
From: Yi Tao <escape@...ux.alibaba.com>
To: hannes@...xchg.org,
	surenb@...gle.com,
	peterz@...radead.org
Cc: linux-kernel@...r.kernel.org
Subject: [PATCH] sched/psi: Fix the bug where the last character is overwritten

The buffer buf in psi_write has only 32 bytes, and to ensure the correct
parsing of the string, it needs to be terminated with '\0', which means
users can input no more than 31 characters. When the user inputs fewer
than 31 characters, buf_size equals nbytes, which causes the last
character entered by the user to be overwritten by '\0', affecting the
parsing results.

Here is a specific example.

$echo -n "some 500000 1000000" > /proc/pressure/cpu
$bash: echo: write error: Invalid argument

Because the last character is overwritten, the value obtained by sscanf
parsing is 500000 and 100000; window_us is missing a zero, hence the
return of -EINVAL.

The reason 'echo' without the '-n' flag can be parsed correctly is
because the last character that gets overwritten is '\n', so it won't
return an error.

Limiting buf_size to no more than 31 and writing '\0' at the position of
buf_size can fix this bug.

Signed-off-by: Yi Tao <escape@...ux.alibaba.com>
---
 kernel/sched/psi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 7b4aa5809c0f..5ae336e1c2d8 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -1523,11 +1523,11 @@ static ssize_t psi_write(struct file *file, const char __user *user_buf,
 	if (!nbytes)
 		return -EINVAL;

-	buf_size = min(nbytes, sizeof(buf));
+	buf_size = min(nbytes, sizeof(buf) - 1);
 	if (copy_from_user(buf, user_buf, buf_size))
 		return -EFAULT;

-	buf[buf_size - 1] = '\0';
+	buf[buf_size] = '\0';

 	seq = file->private_data;

-- 
2.32.0.3.g01195cf9f