This is a note to let you know that I've just added the patch titled
seq_buf: Fix seq_buf_vprintf() truncation
to the 3.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
seq_buf-fix-seq_buf_vprintf-truncation.patch
and it can be found in the queue-3.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 4a8fe4e1811c96ad0ad9f4083f2fe4fb43b2988d Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Red Hat)" <rostedt@xxxxxxxxxxx>
Date: Wed, 4 Mar 2015 09:56:02 -0500
Subject: seq_buf: Fix seq_buf_vprintf() truncation
From: "Steven Rostedt (Red Hat)" <rostedt@xxxxxxxxxxx>
commit 4a8fe4e1811c96ad0ad9f4083f2fe4fb43b2988d upstream.
In seq_buf_vprintf(), vsnprintf() is used to copy the format into the
buffer remaining in the seq_buf structure. The return of vsnprintf()
is the amount of characters written to the buffer excluding the '\0',
unless the line was truncated!
If the line copied does not fit, it is truncated, and a '\0' is added
to the end of the buffer. But in this case, '\0' is included in the length
of the line written. To know if the buffer had overflowed, the return
length will be the same as the length of the buffer passed in.
The check in seq_buf_vprintf() only checked if the length returned from
vsnprintf() would fit in the buffer, as the seq_buf_vprintf() is only
to be an all or nothing command. It either writes all the string into
the seq_buf, or none of it. If the string is truncated, the pointers
inside the seq_buf must be reset to what they were when the function was
called. This is not the case. On overflow, it copies only part of the string.
The fix is to change the overflow check to see if the length returned from
vsnprintf() is less than the length remaining in the seq_buf buffer, and not
if it is less than or equal to as it currently does. Then seq_buf_vprintf()
will know if the write from vsnpritnf() was truncated or not.
Signed-off-by: Steven Rostedt <rostedt@xxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
lib/seq_buf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -61,7 +61,7 @@ int seq_buf_vprintf(struct seq_buf *s, c
if (s->len < s->size) {
len = vsnprintf(s->buffer + s->len, s->size - s->len, fmt, args);
- if (seq_buf_can_fit(s, len)) {
+ if (s->len + len < s->size) {
s->len += len;
return 0;
}
Patches currently in stable-queue which might be from rostedt@xxxxxxxxxxx are
queue-3.19/ftrace-clear-regs_en-and-tramp_en-flags-on-disabling-record-via-sysctl.patch
queue-3.19/seq_buf-fix-seq_buf_vprintf-truncation.patch
queue-3.19/ftrace-fix-en-dis-able-graph-caller-when-en-dis-abling-record-via-sysctl.patch
queue-3.19/ftrace-fix-ftrace-enable-ordering-of-sysctl-ftrace_enabled.patch
queue-3.19/seq_buf-fix-seq_buf_bprintf-truncation.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html