Re: [PATCH v2] seq_buf: Mark a seq_buf overflowed when terminating it loses a byte

[Alejandro Colomar]

Hi Kees,

> Date: 2026-10-30 12:20:54-0700
> From: Kees Cook <kees@xxxxxxxxxx>
>
[...]
> 
> Reported-by: Steven Rostedt <rostedt@xxxxxxxxxxx>
> Closes: https://lore.kernel.org/all/20261016145928.16eddc9a@xxxxxxxxxxxxxxxxxx/
> Fixes: 8d1478bfd63be ("seq_buf: Add seq_buf_strlen()")

That Fixes tag seems wrong.  That commit was only moving code around,
AFAICS.  I see the bug already present in v5.13, when
seq_buf_terminate() was added.

	$ git show v5.13:include/linux/seq_buf.h | grepc seq_buf_terminate;
	(standard input):static inline void seq_buf_terminate(struct seq_buf *s)
	{
		if (WARN_ON(s->size == 0))
			return;

		if (seq_buf_buffer_left(s))
			s->buffer[s->len] = 0;
		else
			s->buffer[s->size - 1] = 0;
	}

Back then, we already had a _putmem() function that could fill the
entire buffer:

	$ git show v5.13:lib/seq_buf.c | grepc seq_buf_putmem;
	(standard input):int seq_buf_putmem(struct seq_buf *s, const void *mem, unsigned int len)
	{
		WARN_ON(s->size == 0);

		if (seq_buf_can_fit(s, len)) {
			memcpy(s->buffer + s->len, mem, len);
			s->len += len;
			return 0;
		}
		seq_buf_set_overflow(s);
		return -1;
	}

	$ git show v5.13:lib/seq_buf.c | grepc seq_buf_can_fit;
	(standard input):static bool seq_buf_can_fit(struct seq_buf *s, size_t len)
	{
		return s->len + len <= s->size;
	}

Unless I'm missing something, the bug was introduced in f2616c772c76
(2021-03-18; "seq_buf: Add seq_buf_terminate() API").  Thus:

	Fixes: f2616c772c768 ("seq_buf: Add seq_buf_terminate() API")


Have a lovely night!
Alex

> Signed-off-by: Kees Cook <kees@xxxxxxxxxx>

-- 
<https://www.alejandro-colomar.es>

Attachment: signature.asc
Description: PGP signature