From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9543C83F20 for ; Thu, 10 Jul 2025 21:31:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7CEEC8D0003; Thu, 10 Jul 2025 17:31:21 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7A62F8D0001; Thu, 10 Jul 2025 17:31:21 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6E33B8D0003; Thu, 10 Jul 2025 17:31:21 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 5F10D8D0001 for ; Thu, 10 Jul 2025 17:31:21 -0400 (EDT) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id EAB6910B8C5 for ; Thu, 10 Jul 2025 21:31:20 +0000 (UTC) X-FDA: 83649651120.05.E33A4D4 Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by imf05.hostedemail.com (Postfix) with ESMTP id E5091100011 for ; Thu, 10 Jul 2025 21:31:18 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=lWuo1Zql; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf05.hostedemail.com: domain of alx@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=alx@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1752183079; a=rsa-sha256; cv=none; b=NoPJqrTnNeSVMkScwn/Z27yYnwoYciERwFsDZvPTkyedq2hZRDykbgGDSx9o/KIqlgjpJ/ uYELK8/qxvJLilTNsHDX7EMOwy9RXMwzDTA157Bxe89vGj+gTqzgy9BujIeG6JlZaNKxc8 roBXHbsN3/Eia/IxP4VKYza5+zYYZHw= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=lWuo1Zql; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf05.hostedemail.com: domain of alx@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=alx@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1752183079; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=kxlwBtIVhGWZ8OoO7pHlpnuOe3FSmc3gWsDT8zjGSd4=; b=sJLpxZ0M57z5HKk5BiGe/WKhIeYL2jeNJ2ds7RZVnrgFPVWIwPBGx0cElk06S0t473JBy6 rim65R9Zd7mUsC+vDBNOsaP5EQQAmGliJxj5u2x38gjOHpPVSCwGQizqVVumyuDUwkMpS+ VoRMZDjZHVDBtypF2L3p0NNyxKH8ufY= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 15CCD470A8; Thu, 10 Jul 2025 21:31:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D0DAC4CEF4; Thu, 10 Jul 2025 21:31:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1752183077; bh=wFPXfnEZslZWUhJFarJBIrU2i1EIAu502D8Y+SMDH6M=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=lWuo1ZqlT8hDeYCOdQ83TdmvF3KTGpYjhd5zydhkKWryMLsY/yiK+N6Gb3hmh8X/T AT6fkItdv8vi0RopIXquZcY2WFs4NBlcXWveYLG3SKhskex1XkYyHoMRFE8Pq7nPB3 crYWMOb94V+RVJyuUPctglxGyyzCbhKkWT2uzfxIefWUfg+Sz/9dQny5+GJ2fuz0Uv xdbLu4BrdKkWrkzDFkqjrV3HQCOdPfSoAoD6/Bp8p5Tsa71nXhuP2XPQvCggDV5+th VUF7d2SevWeaVFMTwzUITeFqMKVJWvf9fnbkuosGwlSy0jzVnGlzRaFkg6XYuwSTQv INmQKlW3JVmxw== Date: Thu, 10 Jul 2025 23:31:11 +0200 From: Alejandro Colomar To: linux-mm@kvack.org, linux-hardening@vger.kernel.org Cc: Alejandro Colomar , Kees Cook , Christopher Bazley , shadow <~hallyn/shadow@lists.sr.ht>, linux-kernel@vger.kernel.org, Andrew Morton , kasan-dev@googlegroups.com, Dmitry Vyukov , Alexander Potapenko , Marco Elver , Christoph Lameter , David Rientjes , Vlastimil Babka , Roman Gushchin , Harry Yoo , Andrew Clayton , Rasmus Villemoes , Michal Hocko , Linus Torvalds , Al Viro , Martin Uecker , Sam James , Andrew Pinski , Jann Horn Subject: [RFC v5 5/7] mm: Fix benign off-by-one bugs Message-ID: <515445ae064d4b8599899bf0d8b480dadd2ff843.1752182685.git.alx@kernel.org> X-Mailer: git-send-email 2.50.0 References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: X-Rspamd-Server: rspam11 X-Rspam-User: X-Stat-Signature: 7h8j14iiatbafp8tafddqwdpwhys7mqf X-Rspamd-Queue-Id: E5091100011 X-HE-Tag: 1752183078-908018 X-HE-Meta: U2FsdGVkX1/6ZblS95N9t8LGVw1xdgPhOUZj89Wm8ViHN9vmEPgYHJsuXaY+bgBOgJGPacFCuZJiC40v83TQG6jU8AlPA1TGmDv+1iu/obtiCLpY7tRgKbnpTCybL4TloXiAolC/okVi4MvY3hOUynpKsAVuKybB/uEKl+WbNy6j2A9JIx6zAoIq7h29mZ5Ln/kaMs6P5lD69M3hFm31zYCbV1HQ4/dcQmI0oUUxeo/bUfIojyyXBYOOfrIo3MW6aIS9XUU2DeHO4pxk3b4YnLWrp2bhjf1i9bJEiEduJzPQNvKEFXQdi0o/0w2ctcBUwgi9QRJs1HqrNLoyEq0tt08/MAJ/vX/+TipopfrxrApg02OVmLJxWKVPaFTtjH9bx0hQk0NuGv/iYCzYyity0pIC+RYnoOx7ihAhCboenDRAF/SHQ8eMgjMU/rocL8WSllZFG5prp3GkoEun++JjZ1rJkD9y6V+PhOAQ0dNykIC5ZKfudXnutol6I2Ac6qP3/hMLnzuecnLqDdrDHOXzYZyKFTxiZz6zsMbo/C4cExEx/88YYHlMz9qfCZr+wDydbueemGPm2mJGXECaVQu1DrzguThLymTSXUCYN1k5uTgOFGJB2mdkObLVO7OPKK/1xxm+nqw4blzdpzAE9kK8QdRY8eALffonjzfT+F5IrW0nL0Xrv/Mq/mK+WCF9oCcmZBV4HEZ/6L8Fg3CMlTkM3yrV3z8rac61o/4meB+4zpnnddUvRHJy4EaH8KvW5F3cLML/WHUEQlVNAox5b5BQXbbzLji1uqHEwIMotfJTmGCK6J8J6kpAtyc/M45LxHi9nU4eJ+LwtlY61o2Wra5DI3wlTRtEdNhMGz1ccfIbqzi0qhVCfIO1KGlMbyq+z1G18TcJwTSjghlOhUTXPl+0pLMppxuJ5jtB/oWYJLIiGnwwfsytT30q8OSU1OGWSOrQpRtGAOHSEerPIBSQw0f ZhdgdKXr 21JkzHJf90q4Re1J3d6cEfUFta4dO15qgedeQChYfm6+DNcgFPKnr9x3+xc6Kthc45MoKv9wSUHbqGqI2CmWtieS8M+SWqXNKMQnYRypRThhm7vp9G7uoMx58eTUKoSs04UAOgtQZ2k2wqn+dKq/VW3GRRV8P6JFFimzXZjzjfcMHAgazNmX/ybT6iLg9Le49rbkipm1MRZvBFfee646dKwld8SxapOcTFkT54DQBmlZ6XQvsbJ3Kpvdf54KhcYlHZXaRzhfTbhUrT4Fy0bXR3nUaU26WNpWfpJi4Zh84HDzEIQOFwNetP+FKT/MrpVCjrjD/M8rNi8CJ8BlXCK/LmiMvZ9FsSBlTXr998nMTBfFxr2XEm+Ow43BJ6vKmbLoyj1Xe6P/UGSz+s5lXet7heQoDzAAbEQAEZ97EV1JkVC8ftQHItnT8AFbbdpQnL/hASzptzTXBuIKb86k7jlJem+tgsv+WJX+4qbM7IB9/6WS6m89R2AptJZtbF1aBJ68Arjt/ipOiJmTfSWoMDZwAehjlHZIO9/iXAeoB X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: We were wasting a byte due to an off-by-one bug. s[c]nprintf() doesn't write more than $2 bytes including the null byte, so trying to pass 'size-1' there is wasting one byte. Now that we use sprintf_end(), the situation isn't different: sprintf_end() will stop writing *before* 'end' --that is, at most the terminating null byte will be written at 'end-1'--. Acked-by: Marco Elver Cc: Kees Cook Cc: Christopher Bazley Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Jann Horn Cc: Andrew Morton Cc: Linus Torvalds Cc: Rasmus Villemoes Cc: Marco Elver Cc: Michal Hocko Cc: Al Viro Signed-off-by: Alejandro Colomar --- mm/kfence/kfence_test.c | 4 ++-- mm/kmsan/kmsan_test.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/mm/kfence/kfence_test.c b/mm/kfence/kfence_test.c index bae382eca4ab..c635aa9d478b 100644 --- a/mm/kfence/kfence_test.c +++ b/mm/kfence/kfence_test.c @@ -110,7 +110,7 @@ static bool report_matches(const struct expect_report *r) /* Title */ cur = expect[0]; - end = &expect[0][sizeof(expect[0]) - 1]; + end = ENDOF(expect[0]); switch (r->type) { case KFENCE_ERROR_OOB: cur = sprintf_end(cur, end, "BUG: KFENCE: out-of-bounds %s", @@ -140,7 +140,7 @@ static bool report_matches(const struct expect_report *r) /* Access information */ cur = expect[1]; - end = &expect[1][sizeof(expect[1]) - 1]; + end = ENDOF(expect[1]); switch (r->type) { case KFENCE_ERROR_OOB: diff --git a/mm/kmsan/kmsan_test.c b/mm/kmsan/kmsan_test.c index e48ca1972ff3..9bda55992e3d 100644 --- a/mm/kmsan/kmsan_test.c +++ b/mm/kmsan/kmsan_test.c @@ -105,7 +105,7 @@ static bool report_matches(const struct expect_report *r) /* Title */ cur = expected_header; - end = &expected_header[sizeof(expected_header) - 1]; + end = ENDOF(expected_header); cur = sprintf_end(cur, end, "BUG: KMSAN: %s", r->error_type); -- 2.50.0