From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF42C3E276A; Mon, 18 May 2026 08:15:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.17 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779092108; cv=none; b=TYYoZhCgDGb4nhWJK9pcnxerHVrkLX5NgHHPpRQjU752jp72OGim5N0IEMJB5m3W8UZftrzLLzv25YZemBdo6pj9qZu+/cqplk8m0ANUEkrL5P56jWxHY/9Fr3LoEc2zQz4O9xDbL/dLFFENb+fCvrknO3IVeQf88nbjBcHSF+s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779092108; c=relaxed/simple; bh=03y1ZTW9G/BytRAviEq6s7RpV7ovG3W3nN8jwCgUR70=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=bNEQH5UElnoMQ/QX13ikCQVgnbyI3uczw3nMHUhFAfVN8K7yh31jthFjKuPyW7IEdSs7lzIFYFOdtu3ifExo1NPY2gM3hXW16nuL8PPD5e+7zsuogDj6pCk9Uqp9vtAo7xSOFnkli1ZvqkIyTUxbze7dXubLQv28J9EdwjlM/iY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=jrE7ZGzt; arc=none smtp.client-ip=192.198.163.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="jrE7ZGzt" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1779092106; x=1810628106; h=date:from:to:cc:subject:message-id:references: mime-version:content-transfer-encoding:in-reply-to; bh=03y1ZTW9G/BytRAviEq6s7RpV7ovG3W3nN8jwCgUR70=; b=jrE7ZGzthvnHGE04nwY7u6xd0Ish7VoHehe7mx34cSdmPWndrFdzo+OI vOuUWl+GkeNcvZaa7MLJ7fpQN9dQQTWsBFytItwTpCvAeaC+YEbbVZvMS rl5AuwBvwhxaCNyco9CBEeYxq5cXUtLolE+yMMg7FSW0uCdIpJ7wyzTGf WDu8c58ROMjeUfY5XpZYhO7CBD4BxupZESvTQ/PhTmxFCX0ETkUUAj021 XmUOYW0+QGkzKe1osOYDUrOpJbrzJj4fVpRknjZ8xFHfcZ0lzNbZ3ZmPc LVZzg3EszdXdJaoL3DkERKPem0e9mRfleeU7/2Tiaf6M/vKrBWX66d6e7 Q==; X-CSE-ConnectionGUID: HghaRUO4RduAYkqWkn07vg== X-CSE-MsgGUID: BrZkjRXEQ+aH3kHMFEknxg== X-IronPort-AV: E=McAfee;i="6800,10657,11789"; a="79792362" X-IronPort-AV: E=Sophos;i="6.23,241,1770624000"; d="scan'208";a="79792362" Received: from fmviesa001.fm.intel.com ([10.60.135.141]) by fmvoesa111.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 May 2026 01:15:05 -0700 X-CSE-ConnectionGUID: MAGe3PucTWecG6MXjfkVIQ== X-CSE-MsgGUID: ZU1fDBTrTW+hYKY/CaBnNA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,241,1770624000"; d="scan'208";a="263137490" Received: from fpallare-mobl4.ger.corp.intel.com (HELO localhost) ([10.245.244.3]) by smtpauth.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 May 2026 01:15:03 -0700 Date: Mon, 18 May 2026 11:15:00 +0300 From: Andy Shevchenko To: Geert Uytterhoeven Cc: Andy Shevchenko , Stepan Ionichev , andy@kernel.org, hcazarim@yahoo.com, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] auxdisplay: line-display: fix OOB read on zero-length message_store() Message-ID: References: <20260514174342.28451-1-sozdayvek@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Organization: Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo On Mon, May 18, 2026 at 10:08:07AM +0200, Geert Uytterhoeven wrote: > On Fri, 15 May 2026 at 09:13, Andy Shevchenko wrote: > > On Thu, May 14, 2026 at 8:44 PM Stepan Ionichev wrote: > > > linedisp_display() unconditionally reads msg[count - 1] before > > > checking whether count is zero, so a write of zero bytes to the > > > message sysfs attribute hits msg[-1]: > > > > > > write(fd, "", 0); > > > > > > -> message_store(..., buf, count=0) > > > -> linedisp_display(linedisp, buf, count=0) > > > -> msg[count - 1] == '\n' ; OOB read > > > > > > The kernfs write buffer for that store is a 1-byte allocation > > > (kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0), > > > so msg[-1] is a 1-byte read before the slab object. On a > > > KASAN-enabled kernel this trips an out-of-bounds report and > > > panics; on stock kernels it silently reads adjacent slab data > > > and, if that byte happens to be '\n', the following count-- > > > wraps ssize_t 0 to -1 and is then passed to kmemdup_nul(). > > > > > > linedisp_display() is reached from the message_store() sysfs > > > callback (drivers/auxdisplay/line-display.c message attribute, > > > mode 0644) and from the in-tree initial-message setup with > > > count == -1, so the OOB path is only userspace-triggerable via > > > zero-byte writes; > > > > Isn't it also triggerable when PANEL_BOOT_MESSAGE is left default > > with PANEL_CHANGE_MESSAGE="y"? (However these double quotes makes me > > wonder if this even works, as usually we compare symbols against plain > > 'n'. 'm', or 'y' (without any quotes). > > > > > vfs_write() does not short-circuit on > > > count == 0 and kernfs_fop_write_iter() dispatches the store > > > callback regardless. > > I think PANEL_BOOT_MESSAGE is the only way to trigger this, as > writing an empty string to a device attribute is a no-op according > to commit afcb5a811ff3ab39 ("auxdisplay: img-ascii-lcd: Fix lock-up > when displaying empty string")? If that is still true, the issue > was introduced by commit c8ffef985af564c1 ("auxdisplay: linedisp: > Support configuring the boot message")? Good points. Should I drop the patch and ask for a new commit message (and Fixes tag)? -- With Best Regards, Andy Shevchenko