On Fri, Dec 27, 2013 at 06:18:18PM +0100, Ben Hutchings wrote: > snprintf() returns the number of bytes that could have been written > (excluding the null), not the actual number of bytes written. Given a > long enough subsystem or device name, these functions will advance > beyond the end of the on-stack buffer in dev_vprintk_exit(), resulting > in an information leak or stack corruption. I don't know whether such > a long name is currently possible. > > In case snprintf() returns a value >= the buffer size, do not add > structured logging information. Also WARN the first time this > happens, so we can fix the driver or increase the buffer size. > > Signed-off-by: Ben Hutchings <b...@decadent.org.uk> > --- > drivers/base/core.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/drivers/base/core.c b/drivers/base/core.c > index 67b180d..989a93c 100644 > --- a/drivers/base/core.c > +++ b/drivers/base/core.c > @@ -2022,6 +2022,8 @@ create_syslog_header(const struct device *dev, char > *hdr, size_t hdrlen) > return 0; > > pos += snprintf(hdr + pos, hdrlen - pos, "SUBSYSTEM=%s", subsys); > + if (pos >= hdrlen) > + goto overflow; > > /* > * Add device identifier DEVICE=: > @@ -2053,7 +2055,14 @@ create_syslog_header(const struct device *dev, char > *hdr, size_t hdrlen) > "DEVICE=+%s:%s", subsys, dev_name(dev)); > } > > + if (pos >= hdrlen) > + goto overflow; > + > return pos; > + > +overflow: > + dev_WARN_ONCE(dev, 1, "device/subsystem name too long");
Why only warn once? Any device/subsystem mix should be complained about, if for only that we should be really annoying about it to get it resolved. thanks, greg k-h -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
