Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Sven Schnelle <svens@linux.ibm.com>
To:     John Ogness <john.ogness@linutronix.de>
Cc:     Petr Mladek <pmladek@suse.com>,
        Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>,
        Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
        Steven Rostedt <rostedt@goodmis.org>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] printk: fix buffer overflow potential for print_text()
References: <20210114170412.4819-1-john.ogness@linutronix.de>
        <yt9dk0s48y70.fsf@linux.ibm.com>
        <87v9bomtd0.fsf@jogness.linutronix.de>
        <yt9deeibe4ia.fsf@linux.ibm.com>
Date:   Sat, 23 Jan 2021 22:41:23 +0100
In-Reply-To: <yt9deeibe4ia.fsf@linux.ibm.com> (Sven Schnelle's message of
        "Sat, 23 Jan 2021 22:18:37 +0100")
Message-ID: <yt9d8s8je3gc.fsf@linux.ibm.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

Sven Schnelle <svens@linux.ibm.com> writes:

> John Ogness <john.ogness@linutronix.de> writes:
>
>> On 2021-01-22, Sven Schnelle <svens@linux.ibm.com> wrote:

> I was able to reproduce it in a virtual machine where i have a few more
> ways to debug. What i got was:
>
> 01:  -> 00000000001B8814"  MVI     92001000 >> 000000000163F1CD     CC 2
>
> That's a watchpoint telling me that the code at 0x1b8814 wants to store
> one byte to 0x163f1cd, which is the second byte of console_drivers.
>
> gdb tells me about 0x1b8814:
>
> (gdb) list *(0x1b8814)
> 0x1b8814 is in record_print_text (/home/svens/ibmgit/linux/kernel/printk/printk.c:1402).
> 1397		 * If a buffer was provided, it will be terminated. Space for the
> 1398		 * string terminator is guaranteed to be available. The terminator is
> 1399		 * not counted in the return value.
> 1400		 */
> 1401		if (buf_size > 0)
> 1402			text[len] = 0;

I don't think i have really understood how all the printk magic works,
but using r->text_buf[len] seems to be the correct place to put the zero byte
in that case?

> 1403	
> 1404		return len;
> 1405	}
> 1406
>