Skip to content

Commit 54654ac

Browse files
committed
LKM: address potential buffer overflow on sprint_symbol use
if it sees a wrong symbol longer than 32 bytes, it can actually overflow. chance is very small, but were on kernel space so be defensive. Signed-off-by: backslashxx <[email protected]>
1 parent 38a73f8 commit 54654ac

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

nuke_ext4_lkm/nuke.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ static int ext4_unregister_sysfs_fn(struct super_block *sb)
3636
{
3737
void (*ext4_unregister_sysfs_ptr)(struct super_block *);
3838
const char *sym = "ext4_unregister_sysfs";
39-
char buf[32] = {0};
39+
char buf[KSYM_SYMBOL_LEN] = {0};
4040

4141
if (!symaddr) {
4242
pr_info("mountify/nuke_ext4: symaddr not provided!\n");
@@ -46,7 +46,7 @@ static int ext4_unregister_sysfs_fn(struct super_block *sb)
4646
// https://elixir.bootlin.com/linux/v6.17.1/source/kernel/kallsyms.c#L474
4747
// turns out we can confirm the symbol!
4848
sprint_symbol(buf, symaddr);
49-
buf[31] = '\0';
49+
buf[KSYM_SYMBOL_LEN - 1] = '\0';
5050

5151
// if strstarts symbol
5252
// output is like "ext4_unregister_sysfs+0x0/0x70"

0 commit comments

Comments
 (0)