From 723982e7052e65c3b31e8e8c815ffaf2ecfeaa8f Mon Sep 17 00:00:00 2001 From: Nickolai Zeldovich Date: Fri, 23 Oct 2026 22:01:52 -0400 Subject: [PATCH] panic: zero the dynamically allocated taint buffer A %s read of print_tainted()'s string can run past the end of the taint buffer while another CPU rebuilds a longer string in it, reading slab memory out of bounds into the kernel log (a KASAN slab-out-of-bounds report at taint_buf + size). A warning or an unhandled-signal dump on another CPU reaches print_tainted() through dump_stack_print_info(). alloc_taint_buf() sizes the buffer for the longest taint string and allocates it with kmalloc(), so the bytes past that string are never written and the object holds no permanent NUL terminator. _print_tainted() rebuilds the string in place without locking and writes the terminator last, so a reader that overtakes a writer extending the string past the previous high-water mark finds no terminator inside the object and walks off its end. print_tainted()'s kernel-doc promises the string is "always NULL terminated", a guarantee the previous zero-filled static buffer kept. Allocate the buffer with kzalloc() so its trailing bytes stay NUL and every reader stops inside the object. Reproduced on QEMU riscv64 under KASAN by growing the taint set while processes took unhandled-signal dumps on several CPUs: the unpatched kernel reports a slab-out-of-bounds read at taint_buf + size, the patched one is clean. Link: https://lore.kernel.org/20261024020153.830459-1-nickolai@csail.mit.edu Fixes: a9dff0d0d11c ("kernel/panic: allocate taint string buffer dynamically") Signed-off-by: Nickolai Zeldovich Signed-off-by: Andrew Morton Reviewed-by: Bradley Morgan Reviewed-by: Petr Mladek Cc: Rio Cc: --- kernel/panic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/panic.c b/kernel/panic.c index 574ee5a12f92..91e48d33b7db 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -884,7 +884,7 @@ static __init int alloc_taint_buf(void) size += 1; /* For NULL terminator */ - buf = kmalloc(size, GFP_KERNEL); + buf = kzalloc(size, GFP_KERNEL); if (!buf) { panic("Failed to allocate taint string buffer");