summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorSteven Rostedt (Red Hat) <rostedt@goodmis.org>2015-03-04 23:30:45 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-03-26 13:59:42 +0100
commit0dab26655a339605c62387405d83ad02a4f25a1f (patch)
tree8b1da21d1f7eff1be68e844738f69390b54a55c2 /lib
parentc50360e4aad98374e89cb1147a76fe0b959c612c (diff)
downloadlwn-0dab26655a339605c62387405d83ad02a4f25a1f.tar.gz
lwn-0dab26655a339605c62387405d83ad02a4f25a1f.zip
seq_buf: Fix seq_buf_bprintf() truncation
commit 4d4eb4d4fbd9403682e2b75117b6b895531d8e01 upstream. In seq_buf_bprintf(), bstr_printf() is used to copy the format into the buffer remaining in the seq_buf structure. The return of bstr_printf() is the amount of characters written to the buffer excluding the '\0', unless the line was truncated! If the line copied does not fit, it is truncated, and a '\0' is added to the end of the buffer. But in this case, '\0' is included in the length of the line written. To know if the buffer had overflowed, the return length will be the same or greater than the length of the buffer passed in. The check in seq_buf_bprintf() only checked if the length returned from bstr_printf() would fit in the buffer, as the seq_buf_bprintf() is only to be an all or nothing command. It either writes all the string into the seq_buf, or none of it. If the string is truncated, the pointers inside the seq_buf must be reset to what they were when the function was called. This is not the case. On overflow, it copies only part of the string. The fix is to change the overflow check to see if the length returned from bstr_printf() is less than the length remaining in the seq_buf buffer, and not if it is less than or equal to as it currently does. Then seq_buf_bprintf() will know if the write from bstr_printf() was truncated or not. Link: http://lkml.kernel.org/r/1425500481.2712.27.camel@perches.com Reported-by: Joe Perches <joe@perches.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'lib')
-rw-r--r--lib/seq_buf.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/seq_buf.c b/lib/seq_buf.c
index 795dd94c7fd7..f25c33b279f2 100644
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -154,7 +154,7 @@ int seq_buf_bprintf(struct seq_buf *s, const char *fmt, const u32 *binary)
if (s->len < s->size) {
ret = bstr_printf(s->buffer + s->len, len, fmt, binary);
- if (seq_buf_can_fit(s, ret)) {
+ if (s->len + ret < s->size) {
s->len += ret;
return 0;
}