Messages in this thread | | | Date | Thu, 17 Aug 2023 09:55:22 -0700 | From | Kees Cook <> | Subject | Re: [PATCH] lkdtm: use the return value of strim() |
| |
On Thu, Aug 17, 2023 at 10:21:17PM +0800, GONG, Ruiqi wrote: > From: "GONG, Ruiqi" <gongruiqi1@huawei.com> > > Make use of the return value of strim() to achieve left-trim as well as > right-trim, which prevents the following unusual fail case: > > # echo " EXCEPTION" > /sys/kernel/debug/provoke-crash/DIRECT > sh: write error: Invalid argument > > Link: https://github.com/KSPP/linux/issues/337 > Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com> > --- > drivers/misc/lkdtm/core.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c > index 0772e4a4757e..812c96461ab2 100644 > --- a/drivers/misc/lkdtm/core.c > +++ b/drivers/misc/lkdtm/core.c > @@ -242,7 +242,7 @@ static ssize_t lkdtm_debugfs_entry(struct file *f, > } > /* NULL-terminate and remove enter */ > buf[count] = '\0'; > - strim(buf); > + buf = strim(buf); > > crashtype = find_crashtype(buf); > free_page((unsigned long)buf);
Will free_page() still work in this case, though? The address won't match the allocation any more...
-Kees
> @@ -318,7 +318,7 @@ static ssize_t direct_entry(struct file *f, const char __user *user_buf, > } > /* NULL-terminate and remove enter */ > buf[count] = '\0'; > - strim(buf); > + buf = strim(buf); > > crashtype = find_crashtype(buf); > free_page((unsigned long) buf); > -- > 2.25.1 >
-- Kees Cook
| |