Skip to content

Commit b06507c

Browse files
Daniel Thompsongregkh
Daniel Thompson
authored and
gregkh
committed
kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ
[ Upstream commit ad99b51 ] Currently the PROMPT variable could be abused to provoke the printf() machinery to read outside the current stack frame. Normally this doesn't matter becaues md is already a much better tool for reading from memory. However the md command can be disabled by not setting KDB_ENABLE_MEM_READ. Let's also prevent PROMPT from being modified in these circumstances. Whilst adding a comment to help future code reviewers we also remove the #ifdef where PROMPT in consumed. There is no problem passing an unused (0) to snprintf when !CONFIG_SMP. argument Reported-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn> Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org> Reviewed-by: Douglas Anderson <dianders@chromium.org> Stable-dep-of: 4f41d30 ("kdb: Fix a potential buffer overflow in kdb_local()") Signed-off-by: Sasha Levin <sashal@kernel.org>
1 parent 6142358 commit b06507c

1 file changed

Lines changed: 8 additions & 4 deletions

File tree

‎kernel/debug/kdb/kdb_main.c‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,13 @@ int kdb_set(int argc, const char **argv)
399399
if (argc != 2)
400400
return KDB_ARGCOUNT;
401401

402+
/*
403+
* Censor sensitive variables
404+
*/
405+
if (strcmp(argv[1], "PROMPT") == 0 &&
406+
!kdb_check_flags(KDB_ENABLE_MEM_READ, kdb_cmd_enabled, false))
407+
return KDB_NOPERM;
408+
402409
/*
403410
* Check for internal variables
404411
*/
@@ -1299,12 +1306,9 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
12991306
*(cmd_hist[cmd_head]) = '\0';
13001307

13011308
do_full_getstr:
1302-
#if defined(CONFIG_SMP)
1309+
/* PROMPT can only be set if we have MEM_READ permission. */
13031310
snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"),
13041311
raw_smp_processor_id());
1305-
#else
1306-
snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"));
1307-
#endif
13081312
if (defcmd_in_progress)
13091313
strncat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN);
13101314

0 commit comments

Comments
 (0)