github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

seq_buf: Add seq_buf_strlen()

Browse Source 
Several strlcat() call sites being converted to seq_buf need behavior
seq_buf doesn't currently provide. The return from seq_buf_used() is
not the length of the string in a seq_buf. Once the buffer is full or
has overflowed it returns the buffer size, which counts the byte that
seq_buf_str() replaces with the NUL, so a caller that needs the string
and its length has to call seq_buf_str() and then walk the string with
strlen().

Move the termination out of seq_buf_str() into a helper that returns
where it put the NUL, and add seq_buf_strlen(), which terminates the
buffer in the same way and returns that offset.

As discussed in review, don't add WARN_ON() for seq_buf_strlen() and
drop it from seq_buf_str().

Add tests comparing seq_buf_strlen() against strlen() of seq_buf_str()
for empty, appended, truncated, exactly full, and overflowed buffers,
checking that seq_buf_strlen() alone terminates a full buffer, and
checking that a zero-sized seq_buf reports an empty string from both
accessors without touching the buffer.

Tests passed under qemu on ARCH=x86_64 with GCC 16.2.0 and CONFIG_KASAN=y,
and on big-endian ARCH=s390 with GCC s390x-linux-gnu 16.2.0.

Assisted-by: LLM
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20261005155708.1471260-6-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Kees Cook 2026-10-05 08:56:56 -07:00
parent ea5666e567
commit 8d1478bfd6
2 changed files with 190 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
include/linux/seq_buf.h
View File

@ -89,6 +89,27 @@ static inline unsigned int seq_buf_used(struct seq_buf *s)
return min(s->len, s->size);
}
/*
* NUL-terminate the buffer in @s: directly after the data when there is
* room for it, otherwise in the last byte of the buffer. @s->size must not
* be zero.
*
* Returns: the offset of the NUL.
*/
static inline size_t __seq_buf_terminate(struct seq_buf *s)
{
size_t end;
if (seq_buf_buffer_left(s))
end = s->len;
else
end = s->size - 1;
s->buffer[end] = 0;
return end;
}
/**
* seq_buf_str - get NUL-terminated C string from seq_buf
* @s: the seq_buf handle
@ -98,7 +119,14 @@ static inline unsigned int seq_buf_used(struct seq_buf *s)
*
* Note, if this is called when the buffer has overflowed, then
* the last byte of the buffer is zeroed, and the len will still
* point passed it.
* point passed it. The same happens when the buffer is exactly
* full: the NUL takes the place of the last byte written, which is
* lost, though seq_buf_used() still counts it.
*
* A zero-sized seq_buf has nowhere to put a NUL, so the empty string
* is returned instead of writing to @s->buffer. Any other seq_buf
* returns @s->buffer, even when it holds an empty string, so callers
* always get their own buffer back.
*
* After this function is called, s->buffer is safe to use
* in string operations.
@ -107,17 +135,44 @@ static inline unsigned int seq_buf_used(struct seq_buf *s)
*/
static inline const char *seq_buf_str(struct seq_buf *s)
{
if (WARN_ON(s->size == 0))
if (s->size == 0)
return "";
if (seq_buf_buffer_left(s))
s->buffer[s->len] = 0;
else
s->buffer[s->size - 1] = 0;
__seq_buf_terminate(s);
return s->buffer;
}
/**
* seq_buf_strlen - get the length of the NUL-terminated C string in seq_buf
* @s: the seq_buf handle
*
* This makes sure that the buffer in @s is NUL-terminated, exactly as
* seq_buf_str() does, and returns the length of the resulting string
* without walking it. Unlike seq_buf_used(), this does not count the byte
* given up to the NUL when the buffer is full or has overflowed. When the
* buffer is exactly full, that byte is the last one written, and calling
* either function loses it.
*
* A zero-sized seq_buf holds no string, so 0 is returned without writing
* to @s->buffer, matching what seq_buf_str() returns for one.
*
* After this function is called, s->buffer is safe to use
* in string operations.
*
* Returns: the offset of the NUL that terminates @s->buffer. That is the
* length of the string unless an earlier NUL is in the way, either one the
* data written to @s carried itself, or one seq_buf_set_overflow() left
* behind when it cleared what no writer had claimed.
*/
static inline size_t seq_buf_strlen(struct seq_buf *s)
{
if (s->size == 0)
return 0;
return __seq_buf_terminate(s);
}
/**
* seq_buf_get_buf - get buffer to write arbitrary data to
* @s: the seq_buf handle

129
lib/tests/seq_buf_kunit.c
View File

@ -25,6 +25,7 @@ static void seq_buf_init_test(struct kunit *test)
KUNIT_EXPECT_EQ(test, seq_buf_buffer_left(&s), 32);
KUNIT_EXPECT_EQ(test, seq_buf_used(&s), 0);
KUNIT_EXPECT_STREQ(test, seq_buf_str(&s), "");
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 0);
}
static void seq_buf_declare_test(struct kunit *test)
@ -509,6 +510,128 @@ static void seq_buf_path_overflow_test(struct kunit *test)
KUNIT_EXPECT_STREQ(test, seq_buf_str(&s), expected);
}
static void seq_buf_strlen_test(struct kunit *test)
{
DECLARE_SEQ_BUF(s, 16);
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 0);
KUNIT_EXPECT_STREQ(test, seq_buf_str(&s), "");
seq_buf_puts(&s, "hello");
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 5);
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), strlen(seq_buf_str(&s)));
seq_buf_printf(&s, " %s", "world");
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 11);
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), strlen(seq_buf_str(&s)));
}
static void seq_buf_strlen_printf_overflow_test(struct kunit *test)
{
DECLARE_SEQ_BUF(s, 16);
DECLARE_SEQ_BUF(t, 8);
seq_buf_printf(&s, "%s", "1234567890abcdefghij");
KUNIT_EXPECT_TRUE(test, seq_buf_has_overflowed(&s));
KUNIT_EXPECT_EQ(test, seq_buf_used(&s), 16);
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 15);
KUNIT_EXPECT_STREQ(test, seq_buf_str(&s), "1234567890abcde");
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), strlen(seq_buf_str(&s)));
/* Output one byte too long for the NUL. */
seq_buf_printf(&t, "%s", "12345678");
KUNIT_EXPECT_TRUE(test, seq_buf_has_overflowed(&t));
KUNIT_EXPECT_EQ(test, seq_buf_used(&t), 8);
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&t), 7);
KUNIT_EXPECT_STREQ(test, seq_buf_str(&t), "1234567");
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&t), strlen(seq_buf_str(&t)));
}
static void seq_buf_strlen_full_test(struct kunit *test)
{
DECLARE_SEQ_BUF(s, 4);
DECLARE_SEQ_BUF(t, 8);
char *buf;
size_t len;
/* Filled exactly, with no room left for a NUL, but not overflowed. */
seq_buf_putc(&s, 'a');
seq_buf_putc(&s, 'b');
seq_buf_putc(&s, 'c');
seq_buf_putc(&s, 'd');
KUNIT_EXPECT_FALSE(test, seq_buf_has_overflowed(&s));
KUNIT_EXPECT_EQ(test, seq_buf_used(&s), 4);
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 3);
/* seq_buf_strlen() terminates the buffer by itself. */
KUNIT_EXPECT_EQ(test, s.buffer[3], '\0');
KUNIT_EXPECT_EQ(test, strnlen(s.buffer, s.size), 3);
KUNIT_EXPECT_STREQ(test, seq_buf_str(&s), "abc");
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), strlen(seq_buf_str(&s)));
/* A printf into a full buffer writes nothing. */
KUNIT_EXPECT_EQ(test, seq_buf_printf(&s, "%s", "x"), -1);
KUNIT_EXPECT_TRUE(test, seq_buf_has_overflowed(&s));
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 3);
KUNIT_EXPECT_STREQ(test, seq_buf_str(&s), "abc");
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), strlen(seq_buf_str(&s)));
len = seq_buf_get_buf(&t, &buf);
KUNIT_ASSERT_EQ(test, len, 8);
memset(buf, 'z', len);
seq_buf_commit(&t, len);
KUNIT_EXPECT_FALSE(test, seq_buf_has_overflowed(&t));
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&t), 7);
KUNIT_EXPECT_EQ(test, t.buffer[7], '\0');
KUNIT_EXPECT_EQ(test, strnlen(t.buffer, t.size), 7);
KUNIT_EXPECT_STREQ(test, seq_buf_str(&t), "zzzzzzz");
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&t), strlen(seq_buf_str(&t)));
}
static void seq_buf_strlen_puts_overflow_test(struct kunit *test)
{
DECLARE_SEQ_BUF(s, 16);
/* A puts that does not fit copies as much as fits. */
seq_buf_puts(&s, "hello");
KUNIT_EXPECT_EQ(test, seq_buf_puts(&s, " this does not fit"), -1);
KUNIT_EXPECT_TRUE(test, seq_buf_has_overflowed(&s));
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 15);
KUNIT_EXPECT_STREQ(test, seq_buf_str(&s), "hello this does");
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), strlen(seq_buf_str(&s)));
}
static void seq_buf_strlen_embedded_nul_test(struct kunit *test)
{
static const char data[] = "ab\0cd";
DECLARE_SEQ_BUF(s, 16);
/*
* seq_buf_strlen() reports where it put the terminator, not where
* the first NUL is, so data carrying a NUL of its own makes the two
* disagree. That is expected, and is what the documented caveat is
* about.
*/
seq_buf_putmem(&s, data, sizeof(data) - 1);
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 5);
KUNIT_EXPECT_EQ(test, strlen(seq_buf_str(&s)), 2);
}
static void seq_buf_strlen_zero_size_test(struct kunit *test)
{
char buf[] = "untouched";
struct seq_buf s;
/*
* A zero-sized seq_buf has nowhere to put a terminator. Both
* accessors report an empty string and leave the buffer alone
* rather than writing outside it.
*/
seq_buf_init(&s, buf, 0);
KUNIT_EXPECT_EQ(test, seq_buf_strlen(&s), 0);
KUNIT_EXPECT_STREQ(test, seq_buf_str(&s), "");
KUNIT_EXPECT_STREQ(test, buf, "untouched");
}
static struct kunit_case seq_buf_test_cases[] = {
KUNIT_CASE(seq_buf_init_test),
KUNIT_CASE(seq_buf_declare_test),
@ -526,6 +649,12 @@ static struct kunit_case seq_buf_test_cases[] = {
KUNIT_CASE(seq_buf_putmem_partial_overflow_test),
KUNIT_CASE(seq_buf_putmem_hex_partial_overflow_test),
KUNIT_CASE(seq_buf_path_overflow_test),
KUNIT_CASE(seq_buf_strlen_test),
KUNIT_CASE(seq_buf_strlen_printf_overflow_test),
KUNIT_CASE(seq_buf_strlen_full_test),
KUNIT_CASE(seq_buf_strlen_puts_overflow_test),
KUNIT_CASE(seq_buf_strlen_embedded_nul_test),
KUNIT_CASE(seq_buf_strlen_zero_size_test),
KUNIT_CASE(seq_buf_do_printk_test),
{}
};