From af20aad1ddcea3e74a1c779a84a57fc9e9cbdd08 Mon Sep 17 00:00:00 2001 From: Shengzhuo Wei Date: Sat, 25 Apr 2026 04:29:24 +0800 Subject: [PATCH] um: mconsole: Fix out-of-bounds read in mconsole_log() mconsole_parse() matches the 3-byte prefix "log", but mconsole_log() skips strlen("log ") = 4 bytes, advancing ptr past the NUL terminator when a client sends "log" without a trailing space. The length then comes from req->len, the raw recvfrom() count, instead of req->request.len, so printk() reads up to req->len - 4 bytes of stale data from a previous request left in the static mc_request buffer, leaking it to the kernel log. Use req->cmd->command for the actual command length, add skip_spaces(), use req->request.len, and guard against non-positive length. Signed-off-by: Shengzhuo Wei Link: https://patch.msgid.link/20260425-mconsole-oob-read-leak-v1-1-7d46e5892c5c@cherr.cc Signed-off-by: Johannes Berg --- arch/um/drivers/mconsole_kern.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c index 18d0ec15557c..f01b7d8a07bc 100644 --- a/arch/um/drivers/mconsole_kern.c +++ b/arch/um/drivers/mconsole_kern.c @@ -117,10 +117,12 @@ void mconsole_log(struct mc_request *req) int len; char *ptr = req->request.data; - ptr += strlen("log "); + ptr += strlen(req->cmd->command); + ptr = skip_spaces(ptr); - len = req->len - (ptr - req->request.data); - printk(KERN_WARNING "%.*s", len, ptr); + len = req->request.len - (ptr - req->request.data); + if (len > 0) + printk(KERN_WARNING "%.*s", len, ptr); mconsole_reply(req, "", 0, 0); }