From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933511AbdDSIJA convert rfc822-to-8bit (ORCPT ); Wed, 19 Apr 2017 04:09:00 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:50666 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1760372AbdDSIIx (ORCPT ); Wed, 19 Apr 2017 04:08:53 -0400 Date: Wed, 19 Apr 2017 08:08:40 +0000 From: "Naveen N. Rao" Subject: RE: [PATCH v2 1/5] kprobes: convert kprobe_lookup_name() to a function To: David Laight , Michael Ellerman Cc: "linux-kernel@vger.kernel.org" , "linuxppc-dev@lists.ozlabs.org" , Masami Hiramatsu , Ingo Molnar References: <2780c632bc2c6e39f27920f8cc98e17430189e27.1491991939.git.naveen.n.rao@linux.vnet.ibm.com> <063D6719AE5E284EB5DD2968C1650D6DCFFD3C07@AcuExch.aculab.com> In-Reply-To: <063D6719AE5E284EB5DD2968C1650D6DCFFD3C07@AcuExch.aculab.com> User-Agent: astroid/0.8 (https://github.com/astroidmail/astroid) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT X-TM-AS-MML: disable x-cbid: 17041908-0024-0000-0000-000003CE1256 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17041908-0025-0000-0000-0000114CE320 Message-Id: <1492589122.ncy876vm18.astroid@naverao1-tp.none> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-04-19_06:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1704190076 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Excerpts from David Laight's message of April 18, 2017 18:22: > From: Naveen N. Rao >> Sent: 12 April 2017 11:58 > ... >> +kprobe_opcode_t *kprobe_lookup_name(const char *name) >> +{ > ... >> + char dot_name[MODULE_NAME_LEN + 1 + KSYM_NAME_LEN]; >> + const char *modsym; >> + bool dot_appended = false; >> + if ((modsym = strchr(name, ':')) != NULL) { >> + modsym++; >> + if (*modsym != '\0' && *modsym != '.') { >> + /* Convert to */ >> + strncpy(dot_name, name, modsym - name); >> + dot_name[modsym - name] = '.'; >> + dot_name[modsym - name + 1] = '\0'; >> + strncat(dot_name, modsym, >> + sizeof(dot_name) - (modsym - name) - 2); >> + dot_appended = true; > > If the ':' is 'a way down' name[] then although the strncpy() won't > overrun dot_name[] the rest of the code can. Nice catch, thanks David! We need to be validating the length of 'name'. I'll put out a patch for that. As an aside, I'm not sure I follow what you mean when you say that the strncpy() won't overrun dot_name[]. If we have a name[] longer than sizeof(dot_name) with the ':' after that, the strncpy() can also overrun dot_name[]. - Naveen > > The strncat() call is particularly borked. > > David > >