Daniel Thompson 89e1eb61a8 kdb: Fix buffer overflow during tab-complete ... ANBZ: #12877 commit e9730744bf upstream. Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around. Reported-by: Justin Stitt <justinstitt@google.com> Closes: https://lore.kernel.org/all/CAFhGd8qESuuifuHsNjFPR-Va3P80bxrw+LqvC8deA8GziUJLpw@mail.gmail.com/ Cc: stable@vger.kernel.org Reviewed-by: Douglas Anderson <dianders@chromium.org> Reviewed-by: Justin Stitt <justinstitt@google.com> Tested-by: Justin Stitt <justinstitt@google.com> Link: https://lore.kernel.org/r/20240424-kgdb_read_refactor-v3-1-f236dbe9828d@linaro.org Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org> Fixes: CVE-2024-39480 Signed-off-by: Xiao Long <xiaolong@openanolis.org> Signed-off-by: Qinyun Tan <qinyuntan@linux.alibaba.com> Reviewed-by: Xunlei Pang <xlpang@linux.alibaba.com> Link: https://gitee.com/anolis/cloud-kernel/pulls/4314		2024-12-27 08:22:57 +00:00
..
kdb	kdb: Fix buffer overflow during tab-complete	2024-12-27 08:22:57 +00:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
debug_core.c	smp: Cleanup smp_call_function*()	2024-01-03 14:27:31 +00:00
debug_core.h	kdb: Fix stack crawling on 'running' CPUs that aren't the master	2019-10-10 16:28:48 +01:00
gdbstub.c	kernel: debug: Centralize dbg_[de]activate_sw_breakpoints	2020-10-01 14:23:45 +01:00