| From a0700d6fc8e30bdafdb3b92535ab3f32b78afd99 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sat, 25 Nov 2023 13:05:04 +0100 |
| Subject: kdb: Fix a potential buffer overflow in kdb_local() |
| |
| From: Christophe JAILLET <christophe.jaillet@wanadoo.fr> |
| |
| [ Upstream commit 4f41d30cd6dc865c3cbc1a852372321eba6d4e4c ] |
| |
| When appending "[defcmd]" to 'kdb_prompt_str', the size of the string |
| already in the buffer should be taken into account. |
| |
| An option could be to switch from strncat() to strlcat() which does the |
| correct test to avoid such an overflow. |
| |
| However, this actually looks as dead code, because 'defcmd_in_progress' |
| can't be true here. |
| See a more detailed explanation at [1]. |
| |
| [1]: https://lore.kernel.org/all/CAD=FV=WSh7wKN7Yp-3wWiDgX4E3isQ8uh0LCzTmd1v9Cg9j+nQ@mail.gmail.com/ |
| |
| Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)") |
| Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> |
| Reviewed-by: Douglas Anderson <dianders@chromium.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| kernel/debug/kdb/kdb_main.c | 2 -- |
| 1 file changed, 2 deletions(-) |
| |
| diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c |
| index 438b868cbfa9..35aa2e98a92a 100644 |
| --- a/kernel/debug/kdb/kdb_main.c |
| +++ b/kernel/debug/kdb/kdb_main.c |
| @@ -1349,8 +1349,6 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, |
| /* PROMPT can only be set if we have MEM_READ permission. */ |
| snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"), |
| raw_smp_processor_id()); |
| - if (defcmd_in_progress) |
| - strncat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN); |
| |
| /* |
| * Fetch command from keyboard |
| -- |
| 2.43.0 |
| |
