Received-SPF: pass (google.com: domain of linux-kernel+bounces-28909-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Yi Tao <escape@linux.alibaba.com>
To: hannes@cmpxchg.org,
	surenb@google.com,
	peterz@infradead.org
Cc: linux-kernel@vger.kernel.org
Subject: [PATCH] sched/psi: Fix the bug where the last character is overwritten
Date: Wed, 17 Jan 2024 19:26:01 +0800
Message-Id: <a33440f33d42aab66ad4120303ecbe8dca401d5c.1705490349.git.escape@linux.alibaba.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

The buffer buf in psi_write has only 32 bytes, and to ensure the correct
parsing of the string, it needs to be terminated with '\0', which means
users can input no more than 31 characters. When the user inputs fewer
than 31 characters, buf_size equals nbytes, which causes the last
character entered by the user to be overwritten by '\0', affecting the
parsing results.

Here is a specific example.

$echo -n "some 500000 1000000" > /proc/pressure/cpu
$bash: echo: write error: Invalid argument

Because the last character is overwritten, the value obtained by sscanf
parsing is 500000 and 100000; window_us is missing a zero, hence the
return of -EINVAL.

The reason 'echo' without the '-n' flag can be parsed correctly is
because the last character that gets overwritten is '\n', so it won't
return an error.

Limiting buf_size to no more than 31 and writing '\0' at the position of
buf_size can fix this bug.

Signed-off-by: Yi Tao <escape@linux.alibaba.com>
---
 kernel/sched/psi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 7b4aa5809c0f..5ae336e1c2d8 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -1523,11 +1523,11 @@ static ssize_t psi_write(struct file *file, const char __user *user_buf,
 	if (!nbytes)
 		return -EINVAL;
 
-	buf_size = min(nbytes, sizeof(buf));
+	buf_size = min(nbytes, sizeof(buf) - 1);
 	if (copy_from_user(buf, user_buf, buf_size))
 		return -EFAULT;
 
-	buf[buf_size - 1] = '\0';
+	buf[buf_size] = '\0';
 
 	seq = file->private_data;
 
-- 
2.32.0.3.g01195cf9f