All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] drm: fix off-by-one in logger
       [not found] <1527054785-5417-1-git-send-email-nmanthey@amazon.de>
@ 2018-05-23  6:22   ` Norbert Manthey
  0 siblings, 0 replies; 4+ messages in thread
From: Norbert Manthey @ 2018-05-23  6:22 UTC (permalink / raw)
  Cc: Andrew Morton, Linus Torvalds, stable, Norbert Manthey,
	Alex Deucher, Christian König, David (ChunMing) Zhou,
	David Airlie, Harry Wentland, Tony Cheng, Yongqiang Sun,
	Anthony Koo, Michel Dänzer, Dmytro Laktyushkin,
	Jordan Lazare, Colin Ian King, amd-gfx, dri-devel, linux-kernel

The current implementation will leak a byte to the log via memmove. The
specified 27 bytes are off-by-one, as the payload is 25 bytes, and the
termination character is only one byte large. To avoid this, factor out
the error message, and furthermore make the second parameter of the
append_entry function const.

The full trace is as follows:

In function ‘memmove’,
   from ‘append_entry’ at
        drivers/gpu/drm/amd/display/dc/basics/logger.c:257:2,
   from ‘dm_logger_append_va’ at
        drivers/gpu/drm/amd/display/dc/basics/logger.c:348:4
   detected read beyond size of object passed as 2nd parameter

Signed-off-by: Norbert Manthey <nmanthey@amazon.de>
---
 drivers/gpu/drm/amd/display/dc/basics/logger.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/basics/logger.c b/drivers/gpu/drm/amd/display/dc/basics/logger.c
index 31bee05..6ba8d0c 100644
--- a/drivers/gpu/drm/amd/display/dc/basics/logger.c
+++ b/drivers/gpu/drm/amd/display/dc/basics/logger.c
@@ -244,7 +244,7 @@ static void log_heading(struct log_entry *entry)
 
 static void append_entry(
 		struct log_entry *entry,
-		char *buffer,
+		const char *buffer,
 		uint32_t buf_size)
 {
 	if (!entry->buf ||
@@ -346,7 +346,9 @@ void dm_logger_append_va(
 		if (size < LOG_MAX_LINE_SIZE - 1) {
 			append_entry(entry, buffer, size);
 		} else {
-			append_entry(entry, "LOG_ERROR, line too long\n", 27);
+			static const char msg[] = "LOG_ERROR, line too long\n";
+
+			append_entry(entry, msg, sizeof(msg));
 		}
 	}
 }
-- 
2.7.4

Amazon Development Center Germany GmbH
Berlin - Dresden - Aachen
main office: Krausenstr. 38, 10117 Berlin
Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
Ust-ID: DE289237879
Eingetragen am Amtsgericht Charlottenburg HRB 149173 B

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [PATCH v2] drm: fix off-by-one in logger
@ 2018-05-23  6:22   ` Norbert Manthey
  0 siblings, 0 replies; 4+ messages in thread
From: Norbert Manthey @ 2018-05-23  6:22 UTC (permalink / raw)
  Cc: Andrew Morton, Linus Torvalds, stable, Norbert Manthey,
	Alex Deucher, Christian König, David (ChunMing) Zhou,
	David Airlie, Harry Wentland, Tony Cheng, Yongqiang Sun,
	Anthony Koo, Michel Dänzer, Dmytro Laktyushkin,
	Jordan Lazare, Colin Ian King, amd-gfx, dri-devel, linux-kernel

The current implementation will leak a byte to the log via memmove. The
specified 27 bytes are off-by-one, as the payload is 25 bytes, and the
termination character is only one byte large. To avoid this, factor out
the error message, and furthermore make the second parameter of the
append_entry function const.

The full trace is as follows:

In function ‘memmove’,
   from ‘append_entry’ at
        drivers/gpu/drm/amd/display/dc/basics/logger.c:257:2,
   from ‘dm_logger_append_va’ at
        drivers/gpu/drm/amd/display/dc/basics/logger.c:348:4
   detected read beyond size of object passed as 2nd parameter

Signed-off-by: Norbert Manthey <nmanthey@amazon.de>
---
 drivers/gpu/drm/amd/display/dc/basics/logger.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/basics/logger.c b/drivers/gpu/drm/amd/display/dc/basics/logger.c
index 31bee05..6ba8d0c 100644
--- a/drivers/gpu/drm/amd/display/dc/basics/logger.c
+++ b/drivers/gpu/drm/amd/display/dc/basics/logger.c
@@ -244,7 +244,7 @@ static void log_heading(struct log_entry *entry)
 
 static void append_entry(
 		struct log_entry *entry,
-		char *buffer,
+		const char *buffer,
 		uint32_t buf_size)
 {
 	if (!entry->buf ||
@@ -346,7 +346,9 @@ void dm_logger_append_va(
 		if (size < LOG_MAX_LINE_SIZE - 1) {
 			append_entry(entry, buffer, size);
 		} else {
-			append_entry(entry, "LOG_ERROR, line too long\n", 27);
+			static const char msg[] = "LOG_ERROR, line too long\n";
+
+			append_entry(entry, msg, sizeof(msg));
 		}
 	}
 }
-- 
2.7.4

Amazon Development Center Germany GmbH
Berlin - Dresden - Aachen
main office: Krausenstr. 38, 10117 Berlin
Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
Ust-ID: DE289237879
Eingetragen am Amtsgericht Charlottenburg HRB 149173 B

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH v2] drm: fix off-by-one in logger
  2018-05-23  6:22   ` Norbert Manthey
@ 2018-05-23  9:52     ` Norbert Manthey
  -1 siblings, 0 replies; 4+ messages in thread
From: Norbert Manthey @ 2018-05-23  9:52 UTC (permalink / raw)
  To: Manthey, Norbert
  Cc: Andrew Morton, Linus Torvalds, stable, Alex Deucher,
	Christian König, David (ChunMing) Zhou, David Airlie,
	Harry Wentland, Tony Cheng, Yongqiang Sun, Anthony Koo,
	Michel Dänzer, Dmytro Laktyushkin, Jordan Lazare,
	Colin Ian King, amd-gfx, dri-devel, linux-kernel,
	David Woodhouse

Dear all,

I just noticed that replying to my earlier email thread failed, and that
I thereby created a new thread. The original thread is the following one:
https://lkml.org/lkml/2018/2/16/274

I am sorry for the confusion!

Best,
Norbert


On 05/23/2018 08:22 AM, Norbert Manthey wrote:
> The current implementation will leak a byte to the log via memmove. The
> specified 27 bytes are off-by-one, as the payload is 25 bytes, and the
> termination character is only one byte large. To avoid this, factor out
> the error message, and furthermore make the second parameter of the
> append_entry function const.
>
> The full trace is as follows:
>
> In function ‘memmove’,
>    from ‘append_entry’ at
>         drivers/gpu/drm/amd/display/dc/basics/logger.c:257:2,
>    from ‘dm_logger_append_va’ at
>         drivers/gpu/drm/amd/display/dc/basics/logger.c:348:4
>    detected read beyond size of object passed as 2nd parameter
>
> Signed-off-by: Norbert Manthey <nmanthey@amazon.de>
> ---
>  drivers/gpu/drm/amd/display/dc/basics/logger.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/basics/logger.c b/drivers/gpu/drm/amd/display/dc/basics/logger.c
> index 31bee05..6ba8d0c 100644
> --- a/drivers/gpu/drm/amd/display/dc/basics/logger.c
> +++ b/drivers/gpu/drm/amd/display/dc/basics/logger.c
> @@ -244,7 +244,7 @@ static void log_heading(struct log_entry *entry)
>  
>  static void append_entry(
>  		struct log_entry *entry,
> -		char *buffer,
> +		const char *buffer,
>  		uint32_t buf_size)
>  {
>  	if (!entry->buf ||
> @@ -346,7 +346,9 @@ void dm_logger_append_va(
>  		if (size < LOG_MAX_LINE_SIZE - 1) {
>  			append_entry(entry, buffer, size);
>  		} else {
> -			append_entry(entry, "LOG_ERROR, line too long\n", 27);
> +			static const char msg[] = "LOG_ERROR, line too long\n";
> +
> +			append_entry(entry, msg, sizeof(msg));
>  		}
>  	}
>  }

Amazon Development Center Germany GmbH
Berlin - Dresden - Aachen
main office: Krausenstr. 38, 10117 Berlin
Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
Ust-ID: DE289237879
Eingetragen am Amtsgericht Charlottenburg HRB 149173 B

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH v2] drm: fix off-by-one in logger
@ 2018-05-23  9:52     ` Norbert Manthey
  0 siblings, 0 replies; 4+ messages in thread
From: Norbert Manthey @ 2018-05-23  9:52 UTC (permalink / raw)
  To: Manthey, Norbert
  Cc: Andrew Morton, Linus Torvalds, stable, Alex Deucher,
	Christian König, David (ChunMing) Zhou, David Airlie,
	Harry Wentland, Tony Cheng, Yongqiang Sun, Anthony Koo,
	Michel Dänzer, Dmytro Laktyushkin, Jordan Lazare,
	Colin Ian King, amd-gfx, dri-devel, linux-kernel,
	David Woodhouse

Dear all,

I just noticed that replying to my earlier email thread failed, and that
I thereby created a new thread. The original thread is the following one:
https://lkml.org/lkml/2018/2/16/274

I am sorry for the confusion!

Best,
Norbert


On 05/23/2018 08:22 AM, Norbert Manthey wrote:
> The current implementation will leak a byte to the log via memmove. The
> specified 27 bytes are off-by-one, as the payload is 25 bytes, and the
> termination character is only one byte large. To avoid this, factor out
> the error message, and furthermore make the second parameter of the
> append_entry function const.
>
> The full trace is as follows:
>
> In function ‘memmove’,
>    from ‘append_entry’ at
>         drivers/gpu/drm/amd/display/dc/basics/logger.c:257:2,
>    from ‘dm_logger_append_va’ at
>         drivers/gpu/drm/amd/display/dc/basics/logger.c:348:4
>    detected read beyond size of object passed as 2nd parameter
>
> Signed-off-by: Norbert Manthey <nmanthey@amazon.de>
> ---
>  drivers/gpu/drm/amd/display/dc/basics/logger.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/basics/logger.c b/drivers/gpu/drm/amd/display/dc/basics/logger.c
> index 31bee05..6ba8d0c 100644
> --- a/drivers/gpu/drm/amd/display/dc/basics/logger.c
> +++ b/drivers/gpu/drm/amd/display/dc/basics/logger.c
> @@ -244,7 +244,7 @@ static void log_heading(struct log_entry *entry)
>  
>  static void append_entry(
>  		struct log_entry *entry,
> -		char *buffer,
> +		const char *buffer,
>  		uint32_t buf_size)
>  {
>  	if (!entry->buf ||
> @@ -346,7 +346,9 @@ void dm_logger_append_va(
>  		if (size < LOG_MAX_LINE_SIZE - 1) {
>  			append_entry(entry, buffer, size);
>  		} else {
> -			append_entry(entry, "LOG_ERROR, line too long\n", 27);
> +			static const char msg[] = "LOG_ERROR, line too long\n";
> +
> +			append_entry(entry, msg, sizeof(msg));
>  		}
>  	}
>  }

Amazon Development Center Germany GmbH
Berlin - Dresden - Aachen
main office: Krausenstr. 38, 10117 Berlin
Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
Ust-ID: DE289237879
Eingetragen am Amtsgericht Charlottenburg HRB 149173 B

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-05-23  9:52 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <1527054785-5417-1-git-send-email-nmanthey@amazon.de>
2018-05-23  6:22 ` [PATCH v2] drm: fix off-by-one in logger Norbert Manthey
2018-05-23  6:22   ` Norbert Manthey
2018-05-23  9:52   ` Norbert Manthey
2018-05-23  9:52     ` Norbert Manthey

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.