printk: fix buffer overflow potential for print_text()
authorJohn Ogness <john.ogness@linutronix.de>
Thu, 14 Jan 2021 17:04:12 +0000 (18:10 +0106)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 30 Jan 2021 12:55:20 +0000 (13:55 +0100)
commit861c2e349a36868f9c19a82844b2eb0abf20939b
tree97fc29bb7ba31df0cc609fbe2ca993a14ace52f7
parentcb14bbbb7bbfdb9da25d24cf14f52ef54eee1109
printk: fix buffer overflow potential for print_text()

commit f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 upstream.

Before the commit 896fbe20b4e2333fb55 ("printk: use the lockless
ringbuffer"), msg_print_text() would only write up to size-1 bytes
into the provided buffer. Some callers expect this behavior and
append a terminator to returned string. In particular:

arch/powerpc/xmon/xmon.c:dump_log_buf()
arch/um/kernel/kmsg_dump.c:kmsg_dumper_stdout()

msg_print_text() has been replaced by record_print_text(), which
currently fills the full size of the buffer. This causes a
buffer overflow for the above callers.

Change record_print_text() so that it will only use size-1 bytes
for text data. Also, for paranoia sakes, add a terminator after
the text data.

And finally, document this behavior so that it is clear that only
size-1 bytes are used and a terminator is added.

Fixes: 896fbe20b4e2333fb55 ("printk: use the lockless ringbuffer")
Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210114170412.4819-1-john.ogness@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/printk/printk.c