[patch 11/14] mm/cma_debug.c: fix stack corruption due to sprintf usage

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Prakash Gupta <guptap@xxxxxxxxxxxxxx>
Subject: mm/cma_debug.c: fix stack corruption due to sprintf usage

name[] in cma_debugfs_add_one() can only accommodate 16 chars including
NULL to store sprintf output.  It's common for cma device name to be
larger than 15 chars.  This can cause stack corrpution.  If the gcc stack
protector is turned on, this can cause a panic due to stack corruption.

Below is one example trace:

Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in:
ffffff8e69a75730
Call trace:
  [<ffffff8e68289504>] dump_backtrace+0x0/0x2c4
  [<ffffff8e682897e8>] show_stack+0x20/0x28
  [<ffffff8e685ea808>] dump_stack+0xb8/0xf4
  [<ffffff8e683c454c>] panic+0x154/0x2b0
  [<ffffff8e682a724c>] print_tainted+0x0/0xc0
  [<ffffff8e69a75730>] cma_debugfs_init+0x274/0x290
  [<ffffff8e682839ec>] do_one_initcall+0x5c/0x168
  [<ffffff8e69a50e24>] kernel_init_freeable+0x1c8/0x280

Fix the short sprintf buffer in cma_debugfs_add_one() by using scnprintf()
instead of sprintf().

Link: http://lkml.kernel.org/r/1502446217-21840-1-git-send-email-guptap@xxxxxxxxxxxxxx
Fixes: f318dd083c81 ("cma: Store a name in the cma structure")
Signed-off-by: Prakash Gupta <guptap@xxxxxxxxxxxxxx>
Acked-by: Laura Abbott <labbott@xxxxxxxxxx>
Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---

 mm/cma_debug.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff -puN mm/cma_debug.c~mm-cma-fix-stack-corruption-due-to-sprintf-usage mm/cma_debug.c
--- a/mm/cma_debug.c~mm-cma-fix-stack-corruption-due-to-sprintf-usage
+++ a/mm/cma_debug.c
@@ -167,7 +167,7 @@ static void cma_debugfs_add_one(struct c
 	char name[16];
 	int u32s;
 
-	sprintf(name, "cma-%s", cma->name);
+	scnprintf(name, sizeof(name), "cma-%s", cma->name);
 
 	tmp = debugfs_create_dir(name, cma_debugfs_root);
 
_
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Kernel Archive]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]

  Powered by Linux