2023-01-17 17:34:59

by Petr Mladek

Subject: [PATCH] printk: Use scnprintf() to print the message about the dropped messages on a console

Use scnprintf() for printing the message about dropped messages on
a console. It returns the really written length of the message.
It prevents potential buffer overflow when the returned length is
later used to copy the buffer content.

Note that the previous code was safe because the scratch buffer was
big enough and the message always fit in. But scnprintf() makes
it more safe, definitely.

Reported-by: coverity-bot <[email protected]>
Addresses-Coverity-ID: 1530570 ("Memory - corruptions")
Fixes: c4fcc617e148 ("printk: introduce console_prepend_dropped() for dropped messages")
Link: https://lore.kernel.org/r/202301131544.D9E804CCD@keescook
Signed-off-by: Petr Mladek <[email protected]>
---
kernel/printk/printk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 55338bfd3b55..a9b7dade0d2e 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -2716,7 +2716,7 @@ static void console_prepend_dropped(struct printk_message *pmsg, unsigned long d
char *outbuf = &pbufs->outbuf[0];
size_t len;

- len = snprintf(scratchbuf, scratchbuf_sz,
+ len = scnprintf(scratchbuf, scratchbuf_sz,
"** %lu printk messages dropped **\n", dropped);

/*
--
2.35.3

2023-01-17 23:15:41

by John Ogness

Subject: Re: [PATCH] printk: Use scnprintf() to print the message about the dropped messages on a console

On 2023-01-17, Petr Mladek <[email protected]> wrote:
> Reported-by: coverity-bot <[email protected]>
> Addresses-Coverity-ID: 1530570 ("Memory - corruptions")
> Fixes: c4fcc617e148 ("printk: introduce console_prepend_dropped() for dropped messages")
> Link: https://lore.kernel.org/r/202301131544.D9E804CCD@keescook
> Signed-off-by: Petr Mladek <[email protected]>

Reviewed-by: John Ogness <[email protected]>

2023-01-18 01:35:22

by Sergey Senozhatsky

Subject: Re: [PATCH] printk: Use scnprintf() to print the message about the dropped messages on a console

On (23/01/17 22:54), John Ogness wrote:
> On 2023-01-17, Petr Mladek <[email protected]> wrote:
> > Reported-by: coverity-bot <[email protected]>
> > Addresses-Coverity-ID: 1530570 ("Memory - corruptions")
> > Fixes: c4fcc617e148 ("printk: introduce console_prepend_dropped() for dropped messages")
> > Link: https://lore.kernel.org/r/202301131544.D9E804CCD@keescook
> > Signed-off-by: Petr Mladek <[email protected]>
>
> Reviewed-by: John Ogness <[email protected]>

Reviewed-by: Sergey Senozhatsky <[email protected]>

2023-01-18 10:37:36

by Petr Mladek

Subject: Re: [PATCH] printk: Use scnprintf() to print the message about the dropped messages on a console

On Tue 2023-01-17 17:10:31, Petr Mladek wrote:
> Use scnprintf() for printing the message about dropped messages on
> a console. It returns the really written length of the message.
> It prevents potential buffer overflow when the returned length is
> later used to copy the buffer content.
>
> Note that the previous code was safe because the scratch buffer was
> big enough and the message always fit in. But scnprintf() makes
> it more safe, definitely.
>
> Reported-by: coverity-bot <[email protected]>
> Addresses-Coverity-ID: 1530570 ("Memory - corruptions")
> Fixes: c4fcc617e148 ("printk: introduce console_prepend_dropped() for dropped messages")
> Link: https://lore.kernel.org/r/202301131544.D9E804CCD@keescook
> Signed-off-by: Petr Mladek <[email protected]>

JFYI, the patch has been comitted into printk/linux.git,
branch rework/buffers-cleanup.

Best Regards,
Petr