2021-05-27 15:14:44

by Dietmar Eggemann

Subject: [PATCH] debugfs: Fix debugfs_read_file_str()

Read the entire size of the buffer, including the trailing new line
character.
Discovered while reading the sched domain names of CPU0:

before:

cat /sys/kernel/debug/sched/domains/cpu0/domain*/name
SMTMCDIE

after:

cat /sys/kernel/debug/sched/domains/cpu0/domain*/name
SMT
MC
DIE

Fixes: 9af0440ec86eb ("debugfs: Implement debugfs_create_str()")
Signed-off-by: Dietmar Eggemann <[email protected]>
---
fs/debugfs/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index e813acfaa6e8..ba7c01cd9a5d 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -893,7 +893,7 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,

copy[copy_len] = '\n';

- ret = simple_read_from_buffer(user_buf, count, ppos, copy, copy_len);
+ ret = simple_read_from_buffer(user_buf, count, ppos, copy, len);
kfree(copy);

return ret;
--
2.25.1

2021-05-29 01:54:58

by Steven Rostedt

Subject: Re: [PATCH] debugfs: Fix debugfs_read_file_str()

On Thu, 27 May 2021 11:11:05 +0200
Dietmar Eggemann <[email protected]> wrote:

> +++ b/fs/debugfs/file.c
> @@ -893,7 +893,7 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,
>
> copy[copy_len] = '\n';
>
> - ret = simple_read_from_buffer(user_buf, count, ppos, copy, copy_len);
> + ret = simple_read_from_buffer(user_buf, count, ppos, copy, len);
> kfree(copy);

As we have:

len = strlen(str) + 1;
[..]
copy_len = strscpy(copy, str, len);

I can't think of any situation that len is not equal to copy_len + 1. :-/

Anyway, either "len" or "copy_len + 1" would work.

Reviewed-by: Steven Rostedt (VMware) <[email protected]>

-- Steve

2021-06-04 08:43:15

by Greg Kroah-Hartman

Subject: Re: [PATCH] debugfs: Fix debugfs_read_file_str()

On Fri, Jun 04, 2021 at 10:39:43AM +0200, Peter Zijlstra wrote:
> On Thu, May 27, 2021 at 11:11:05AM +0200, Dietmar Eggemann wrote:
> > Read the entire size of the buffer, including the trailing new line
> > character.
> > Discovered while reading the sched domain names of CPU0:
> >
> > before:
> >
> > cat /sys/kernel/debug/sched/domains/cpu0/domain*/name
> > SMTMCDIE
> >
> > after:
> >
> > cat /sys/kernel/debug/sched/domains/cpu0/domain*/name
> > SMT
> > MC
> > DIE
> >
> > Fixes: 9af0440ec86eb ("debugfs: Implement debugfs_create_str()")
> > Signed-off-by: Dietmar Eggemann <[email protected]>
>
> Urgh.. so much for last minute changes :/
>
> Greg, AFAICT that commit has since landed in Linus, will you take care
> of this?
>
> Acked-by: Peter Zijlstra (Intel) <[email protected]>

Yes, I'll pick it up now, thanks.

greg k-h

2021-06-04 08:43:49

by Peter Zijlstra

Subject: Re: [PATCH] debugfs: Fix debugfs_read_file_str()

On Thu, May 27, 2021 at 11:11:05AM +0200, Dietmar Eggemann wrote:
> Read the entire size of the buffer, including the trailing new line
> character.
> Discovered while reading the sched domain names of CPU0:
>
> before:
>
> cat /sys/kernel/debug/sched/domains/cpu0/domain*/name
> SMTMCDIE
>
> after:
>
> cat /sys/kernel/debug/sched/domains/cpu0/domain*/name
> SMT
> MC
> DIE
>
> Fixes: 9af0440ec86eb ("debugfs: Implement debugfs_create_str()")
> Signed-off-by: Dietmar Eggemann <[email protected]>

Urgh.. so much for last minute changes :/

Greg, AFAICT that commit has since landed in Linus, will you take care
of this?

Acked-by: Peter Zijlstra (Intel) <[email protected]>