Excerpts from David Laight's message of April 18, 2017 18:22:

From: Naveen N. Rao

quoted

Sent: 12 April 2017 11:58

...

quoted

+kprobe_opcode_t *kprobe_lookup_name(const char *name)
+{

...

quoted

+	char dot_name[MODULE_NAME_LEN + 1 + KSYM_NAME_LEN];
+	const char *modsym;
+	bool dot_appended =3D false;
+	if ((modsym =3D strchr(name, ':')) !=3D NULL) {
+		modsym++;
+		if (*modsym !=3D '\0' && *modsym !=3D '.') {
+			/* Convert to <module:.symbol> */
+			strncpy(dot_name, name, modsym - name);
+			dot_name[modsym - name] =3D '.';
+			dot_name[modsym - name + 1] =3D '\0';
+			strncat(dot_name, modsym,
+				sizeof(dot_name) - (modsym - name) - 2);
+			dot_appended =3D true;

=20
If the ':' is 'a way down' name[] then although the strncpy() won't
overrun dot_name[] the rest of the code can.

Nice catch, thanks David!
We need to be validating the length of 'name'. I'll put out a patch for=20
that.

As an aside, I'm not sure I follow what you mean when you say that the=20
strncpy() won't overrun dot_name[]. If we have a name[] longer than=20
sizeof(dot_name) with the ':' after that, the strncpy() can also overrun=20
dot_name[].


- Naveen

=20
The strncat() call is particularly borked.
=20
	David
=20
=20

=