From nobody Mon Jun 29 06:34:24 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2957C6z6k5L9 for ; Mon, 29 Jun 2026 06:34:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc284Nr7z4Gkn for ; Mon, 29 Jun 2026 06:34:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714864; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PxySXQej8+qvD6TVvJXEX9jj7COXZ4PFgYM8elrqnGY=; b=pTdzhUJ+xmw6JZ7uXu8TBjA/eNwEK6QSWW3OU3+O7iO0rpxXJVT+91+2bdZ+VoVjf4ojDa O1QJdgavD/Imz57uaGCiEMyhOwOGj4Shy00J+/Qpb4ZIpT0h13mojs+O+8B5huFjXpzPjS WpE+qGWKuvfc/AmKu0tWhkE9pcpAOQcW/WerW+FL1KFvz5CBDAxF59mOJwRu5XhGfvU08s b+webnGPAjixwc0Y6HySFLtEdqmQyAZuPnMN/HWHN4aVPfBtetXC21EyoYKzJrIBBHvyut R7yFud68lDuWwEa6Okn/zZlJ+4nN7wnBM9S1xikZICVaVX8UdwChMZhlrdwnSA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714864; a=rsa-sha256; cv=none; b=nwwbcSh52V6NmB176IvhvdtALjhuSMoQ6cGlr6rcQyXrjE7GDMV5Ti3wZO0L/BWyI8t3fV RAMsB1rRi5srHZmlSYUvcmTFKWn6LvKSv4ar/hwajlbuxiQbt7Ta+YzsKw+zq309/4Rfcd 5eZaMich/TD8WK4Pf108bihZE2Jn9PZ36ecLMb7+6XA25cphIxttAgAAk74Z602xfHubuK JkulnIlefqW7zB77kF0zYznlGfx3VrhPTbvFmu0f4CYrXda2oFgvKc+N2eg76yT40w2XiV DzSkHYd13p1UGxgpx1kTjYCBN03QbQNkMXmP0XTXShQf4Rxxbd3TR+kdKweHGA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714864; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PxySXQej8+qvD6TVvJXEX9jj7COXZ4PFgYM8elrqnGY=; b=CY4k4U9oO0YeqSJZxoEoaPDwu0u8VYoJyICpkXWP+lT7vMJQMu0O/ebpvq9PVychIWKK9x +4umDJMONr+jAIoe7Thd+tCDXDSQ7Ro5m4nvLbxJbI8UJch49mNW914ezEyZUEvfJz1vFb zfBy9MqpREpPOhtpf1ZdKZ8tIcUtdFN1hPufVOjZQLpLDVhJ3P5Nue+K/CZVTwqA7oVSl8 uPcnvwxd/J1xiodPC/A+SLRvM//KPgx2ET8Vj5O+c7sSlh6prwNhRajdLRAjCFNPK3VRrA ljuXngpZc0NZnevd8MA3VpiNZEGg3AYD51pob+vEp0GdohGsHsjU7z9UIA5vcw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc283H3dzmVK for ; Mon, 29 Jun 2026 06:34:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4689b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 328668cacd73 - stable/15 - linudebugfs: fix simple_attr_write_common() kernel buffer List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 328668cacd735bcdc5fbfe8dbd501e2830f0cc6b Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:24 +0000 Message-Id: <6a4211f0.4689b.249053b7@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=328668cacd735bcdc5fbfe8dbd501e2830f0cc6b commit 328668cacd735bcdc5fbfe8dbd501e2830f0cc6b Author: Bjoern A. Zeeb AuthorDate: 2026-06-10 11:04:20 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:14 +0000 linudebugfs: fix simple_attr_write_common() kernel buffer With 2cf15144daf7e we added a kernel buffer for parsing input copying the user buffer into that. The problem is that we only copy exactly as many bytes as the user supplied. printf 1 would have a write_size of 1, while echo 1 would have a write_size of 2 (1\n). But in order to check and parse we need a terminating '\0'. Overallocate the kernel buffer by 1 and make sure it is always '\0' terminated. Remove the check that the string needs to be of different length than the write_size as this will always fail unless the user passes in, e.g., "1\02\n\0" somehow in which case we won't bother as kstrto*ll() will not only handle the '\n' but also stop at '\0' and should be fine or it will fail and we will error. In theory we could use a static buffer here as well as we know a maximum possible length of digits plus \n and \0 and take a min of that buffer length and write_size and then error on a small buffer but given this is an optional debug interface, do not bother with any alloc (size). Fixes: 2cf15144daf7e ("lindebugfs: Pass user buffer pointers ..") Sponsored by: The FreeBSD Foundation Reviewed by: dumbbell Differential Revision: https://reviews.freebsd.org/D57522 (cherry picked from commit 3fa40c5eb8f57972bf0b329fd2d36af4d2700b8d) --- sys/compat/linuxkpi/common/src/linux_simple_attr.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_simple_attr.c b/sys/compat/linuxkpi/common/src/linux_simple_attr.c index e5514194cb33..54eac3bc65fa 100644 --- a/sys/compat/linuxkpi/common/src/linux_simple_attr.c +++ b/sys/compat/linuxkpi/common/src/linux_simple_attr.c @@ -163,15 +163,12 @@ simple_attr_write_common(struct file *filp, const char __user *ubuf, if (*ppos != 0 || write_size < 1) return (-EINVAL); - buf = malloc(write_size, M_LSATTR, M_WAITOK); + buf = malloc(write_size + 1, M_LSATTR, M_WAITOK); if (copy_from_user(buf, ubuf, write_size) != 0) { free(buf, M_LSATTR); return (-EFAULT); } - if (strnlen(buf, write_size) == write_size) { - free(buf, M_LSATTR); - return (-EINVAL); - } + buf[write_size] = '\0'; mutex_lock(&sattr->mutex);