mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 02:17:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

scripts: modpost: detect and report truncated buf_printf() output

Browse Source 
buf_printf() uses a fixed-size stack buffer. vsnprintf() returns the
number of bytes that *would* have been written to that buffer, which can
be larger than the size of said buffer if the formatted string is too
long.

The problem is that whenever this happens buf_printf() currently passes
this length, unchecked, to buf_write(), which silently reads past the
stack buffer and copies invalid data into the output buffer.

Fix this by detecting vsnprintf() failures and truncations before
appending to the output buffer, and report a fatal error instead of
producing corrupt symbol names.

Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260527-nova-exports-v2-1-06de4c556d55@nvidia.com
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
This commit is contained in:
Alexandre Courbot
2026-05-27 20:52:17 +09:00
committed by Nathan Chancellor
parent 159921d63d
commit d7231d8cb2
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
scripts/mod/modpost.c
View File

@@ -1689,8 +1689,17 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
va_start(ap, fmt);
len = vsnprintf(tmp, SZ, fmt, ap);
buf_write(buf, tmp, len);
va_end(ap);
if (len < 0) {
perror("vsnprintf failed");
exit(1);
}
if (len >= SZ)
fatal("buf_printf output truncated for string %s: %d bytes needed, %d available\n",
tmp, len + 1, SZ);
buf_write(buf, tmp, len);
}
void buf_write(struct buffer *buf, const char *s, int len)