From: Norbert Manthey <nmanthey@amazon.de> To: unlisted-recipients:; (no To-header on input) Cc: "Andrew Morton" <akpm@linux-foundation.org>, "Linus Torvalds" <torvalds@linux-foundation.org>, stable@vger.kernel.org, "Norbert Manthey" <nmanthey@amazon.de>, "Alex Deucher" <alexander.deucher@amd.com>, "Christian König" <christian.koenig@amd.com>, "David (ChunMing) Zhou" <David1.Zhou@amd.com>, "David Airlie" <airlied@linux.ie>, "Harry Wentland" <harry.wentland@amd.com>, "Tony Cheng" <tony.cheng@amd.com>, "Yongqiang Sun" <yongqiang.sun@amd.com>, "Anthony Koo" <Anthony.Koo@amd.com>, "Michel Dänzer" <michel.daenzer@amd.com>, "Dmytro Laktyushkin" <Dmytro.Laktyushkin@amd.com>, "Jordan Lazare" <Jordan.Lazare@amd.com>, "Colin Ian King" <colin.king@canonical.com>, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH v2] drm: fix off-by-one in logger Date: Wed, 23 May 2018 08:22:04 +0200 [thread overview] Message-ID: <1527056531-9568-1-git-send-email-nmanthey@amazon.de> (raw) In-Reply-To: <1527054785-5417-1-git-send-email-nmanthey@amazon.de> The current implementation will leak a byte to the log via memmove. The specified 27 bytes are off-by-one, as the payload is 25 bytes, and the termination character is only one byte large. To avoid this, factor out the error message, and furthermore make the second parameter of the append_entry function const. The full trace is as follows: In function ‘memmove’, from ‘append_entry’ at drivers/gpu/drm/amd/display/dc/basics/logger.c:257:2, from ‘dm_logger_append_va’ at drivers/gpu/drm/amd/display/dc/basics/logger.c:348:4 detected read beyond size of object passed as 2nd parameter Signed-off-by: Norbert Manthey <nmanthey@amazon.de> --- drivers/gpu/drm/amd/display/dc/basics/logger.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/basics/logger.c b/drivers/gpu/drm/amd/display/dc/basics/logger.c index 31bee05..6ba8d0c 100644 --- a/drivers/gpu/drm/amd/display/dc/basics/logger.c +++ b/drivers/gpu/drm/amd/display/dc/basics/logger.c @@ -244,7 +244,7 @@ static void log_heading(struct log_entry *entry) static void append_entry( struct log_entry *entry, - char *buffer, + const char *buffer, uint32_t buf_size) { if (!entry->buf || @@ -346,7 +346,9 @@ void dm_logger_append_va( if (size < LOG_MAX_LINE_SIZE - 1) { append_entry(entry, buffer, size); } else { - append_entry(entry, "LOG_ERROR, line too long\n", 27); + static const char msg[] = "LOG_ERROR, line too long\n"; + + append_entry(entry, msg, sizeof(msg)); } } } -- 2.7.4 Amazon Development Center Germany GmbH Berlin - Dresden - Aachen main office: Krausenstr. 38, 10117 Berlin Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger Ust-ID: DE289237879 Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
WARNING: multiple messages have this Message-ID (diff)
From: Norbert Manthey <nmanthey@amazon.de> Cc: "Andrew Morton" <akpm@linux-foundation.org>, "Linus Torvalds" <torvalds@linux-foundation.org>, stable@vger.kernel.org, "Norbert Manthey" <nmanthey@amazon.de>, "Alex Deucher" <alexander.deucher@amd.com>, "Christian König" <christian.koenig@amd.com>, "David (ChunMing) Zhou" <David1.Zhou@amd.com>, "David Airlie" <airlied@linux.ie>, "Harry Wentland" <harry.wentland@amd.com>, "Tony Cheng" <tony.cheng@amd.com>, "Yongqiang Sun" <yongqiang.sun@amd.com>, "Anthony Koo" <Anthony.Koo@amd.com>, "Michel Dänzer" <michel.daenzer@amd.com>, "Dmytro Laktyushkin" <Dmytro.Laktyushkin@amd.com>, "Jordan Lazare" <Jordan.Lazare@amd.com>, "Colin Ian King" <colin.king@canonical.com>, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.k Subject: [PATCH v2] drm: fix off-by-one in logger Date: Wed, 23 May 2018 08:22:04 +0200 [thread overview] Message-ID: <1527056531-9568-1-git-send-email-nmanthey@amazon.de> (raw) In-Reply-To: <1527054785-5417-1-git-send-email-nmanthey@amazon.de> The current implementation will leak a byte to the log via memmove. The specified 27 bytes are off-by-one, as the payload is 25 bytes, and the termination character is only one byte large. To avoid this, factor out the error message, and furthermore make the second parameter of the append_entry function const. The full trace is as follows: In function ‘memmove’, from ‘append_entry’ at drivers/gpu/drm/amd/display/dc/basics/logger.c:257:2, from ‘dm_logger_append_va’ at drivers/gpu/drm/amd/display/dc/basics/logger.c:348:4 detected read beyond size of object passed as 2nd parameter Signed-off-by: Norbert Manthey <nmanthey@amazon.de> --- drivers/gpu/drm/amd/display/dc/basics/logger.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/basics/logger.c b/drivers/gpu/drm/amd/display/dc/basics/logger.c index 31bee05..6ba8d0c 100644 --- a/drivers/gpu/drm/amd/display/dc/basics/logger.c +++ b/drivers/gpu/drm/amd/display/dc/basics/logger.c @@ -244,7 +244,7 @@ static void log_heading(struct log_entry *entry) static void append_entry( struct log_entry *entry, - char *buffer, + const char *buffer, uint32_t buf_size) { if (!entry->buf || @@ -346,7 +346,9 @@ void dm_logger_append_va( if (size < LOG_MAX_LINE_SIZE - 1) { append_entry(entry, buffer, size); } else { - append_entry(entry, "LOG_ERROR, line too long\n", 27); + static const char msg[] = "LOG_ERROR, line too long\n"; + + append_entry(entry, msg, sizeof(msg)); } } } -- 2.7.4 Amazon Development Center Germany GmbH Berlin - Dresden - Aachen main office: Krausenstr. 38, 10117 Berlin Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger Ust-ID: DE289237879 Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
next parent reply other threads:[~2018-05-23 6:23 UTC|newest] Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top [not found] <1527054785-5417-1-git-send-email-nmanthey@amazon.de> 2018-05-23 6:22 ` Norbert Manthey [this message] 2018-05-23 6:22 ` [PATCH v2] drm: fix off-by-one in logger Norbert Manthey 2018-05-23 9:52 ` Norbert Manthey 2018-05-23 9:52 ` Norbert Manthey
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1527056531-9568-1-git-send-email-nmanthey@amazon.de \ --to=nmanthey@amazon.de \ --cc=Anthony.Koo@amd.com \ --cc=David1.Zhou@amd.com \ --cc=Dmytro.Laktyushkin@amd.com \ --cc=Jordan.Lazare@amd.com \ --cc=airlied@linux.ie \ --cc=akpm@linux-foundation.org \ --cc=alexander.deucher@amd.com \ --cc=amd-gfx@lists.freedesktop.org \ --cc=christian.koenig@amd.com \ --cc=colin.king@canonical.com \ --cc=dri-devel@lists.freedesktop.org \ --cc=harry.wentland@amd.com \ --cc=linux-kernel@vger.kernel.org \ --cc=michel.daenzer@amd.com \ --cc=stable@vger.kernel.org \ --cc=tony.cheng@amd.com \ --cc=torvalds@linux-foundation.org \ --cc=yongqiang.sun@amd.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.