Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   John Ogness <john.ogness@linutronix.de>
To:     Sven Schnelle <svens@linux.ibm.com>
Cc:     Petr Mladek <pmladek@suse.com>,
        Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>,
        Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
        Steven Rostedt <rostedt@goodmis.org>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] printk: fix buffer overflow potential for print_text()
In-Reply-To: <yt9d8s8je3gc.fsf@linux.ibm.com>
References: <20210114170412.4819-1-john.ogness@linutronix.de> <yt9dk0s48y70.fsf@linux.ibm.com> <87v9bomtd0.fsf@jogness.linutronix.de> <yt9deeibe4ia.fsf@linux.ibm.com> <yt9d8s8je3gc.fsf@linux.ibm.com>
Date:   Sun, 24 Jan 2021 09:19:40 +0106
Message-ID: <87k0s2n45n.fsf@jogness.linutronix.de>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

Hi Sven,

Thanks for the outstanding analysis!

On 2021-01-23, Sven Schnelle <svens@linux.ibm.com> wrote:
>> 1401		if (buf_size > 0)
>> 1402			text[len] = 0;
>
> I don't think i have really understood how all the printk magic works,
> but using r->text_buf[len] seems to be the correct place to put the
> zero byte in that case?

Yes, you are correct! @text is pointing to the beginning of the
currently processed line, not the beginning of the buffer.

I will submit a patch to fix our recent fix (unless you would like to do
that).

Thank you for all your help with this!

John Ogness