Kees Cook 9196436ab2 vsprintf: ignore %n again ... This ignores %n in printf again, as was originally documented. Implementing %n poses a greater security risk than utility, so it should stay ignored. To help anyone attempting to use %n, a warning will be emitted if it is encountered. Based on an earlier patch by Joe Perches. Because %n was designed to write to pointers on the stack, it has been frequently used as an attack vector when bugs are found that leak user-controlled strings into functions that ultimately process format strings. While this class of bug can still be turned into an information leak, removing %n eliminates the common method of elevating such a bug into an arbitrary kernel memory writing primitive, significantly reducing the danger of this class of bug. For seq_file users that need to know the length of a written string for padding, please see seq_setwidth() and seq_pad() instead. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: Joe Perches <joe@perches.com> Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: David Miller <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2013-11-15 09:32:20 +09:00
..
fonts	lib: Move fonts from drivers/video/console/ to lib/fonts/	2013-06-28 10:28:22 +02:00
lz4	lz4: fix compression/decompression signedness mismatch	2013-09-11 15:59:45 -07:00
lzo	lib/lzo: Update LZO compression to current upstream version	2013-02-20 19:36:01 +01:00
mpi	alpha: Modernize lib/mpi/longlong.h	2013-07-19 13:54:23 -07:00
raid6	md update for v3.12	2013-09-10 13:03:41 -07:00
reed_solomon
xz	decompressors: fix typo "POWERPC"	2013-03-13 15:21:48 -07:00
zlib_deflate
zlib_inflate
.gitignore	X.509: Implement simple static OID registry	2012-10-08 13:50:18 +10:30
argv_split.c	argv_split(): teach it to handle mutable strings	2013-04-29 18:28:19 -07:00
asn1_decoder.c	Nothing all that exciting; a new module-from-fd syscall for those who want	2012-12-19 07:55:08 -08:00
atomic64.c	lib: atomic64: Initialize locks statically to fix early users	2012-12-20 13:50:16 -08:00
atomic64_test.c
audit.c
average.c
bcd.c
bch.c
bitmap.c	propagate name change to comments in kernel source	2012-12-06 10:39:54 +01:00
bitrev.c
bsearch.c
btree.c
bug.c	taint: add explicit flag to show whether lock dep is still OK.	2013-01-21 17:17:57 +10:30
build_OID_registry	X.509: do not emit any informational output	2013-06-19 17:54:06 +02:00
bust_spinlocks.c	printk: Provide a wake_up_klogd() off-case	2013-03-22 16:41:20 -07:00
check_signature.c
checksum.c	asm-generic headers: Allow yet more arch overrides in checksum.h	2013-02-11 20:00:33 +05:30
clz_ctz.c	lib: add weak clz/ctz functions	2013-07-09 10:33:30 -07:00
clz_tab.c
cmdline.c
cordic.c
cpu-notifier-error-inject.c
cpu_rmap.c	Remove GENERIC_HARDIRQ config option	2013-09-13 15:09:52 +02:00
cpumask.c	bootmem: fix wrong call parameter for free_bootmem()	2012-12-11 17:22:28 -08:00
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c	crypto: crct10dif - Add fallback for broken initrds	2013-09-12 15:31:34 +10:00
crc7.c
crc8.c
crc16.c
crc32.c	lib: crc32: reduce number of cases for crc32{, c}_combine	2013-11-04 15:27:08 -05:00
crc32defs.h
ctype.c
debug_locks.c	mutex: Add support for wound/wait style locks	2013-06-26 12:10:56 +02:00
debugobjects.c	lib/debugobjects.c: remove unnecessary work pending test	2013-11-13 12:09:22 +09:00
dec_and_lock.c
decompress.c	lib: add support for LZ4-compressed kernel	2013-07-09 10:33:30 -07:00
decompress_bunzip2.c
decompress_inflate.c	lib/decompressors: fix "no limit" output buffer length	2013-09-11 15:58:38 -07:00
decompress_unlz4.c	lib: add support for LZ4-compressed kernel	2013-07-09 10:33:30 -07:00
decompress_unlzma.c
decompress_unlzo.c	lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c	2013-02-20 19:36:00 +01:00
decompress_unxz.c
devres.c	lib/devres.c: fix misplaced #endif	2013-02-27 19:10:09 -08:00
digsig.c	lib/digsig.c: use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...))	2013-11-13 12:09:22 +09:00
div64.c	math64: New separate div64_u64_rem helper	2013-08-23 09:02:14 -04:00
dma-debug.c	dma-debug: update DMA debug API to better handle multiple mappings of a buffer	2013-03-22 16:41:20 -07:00
dump_stack.c	x86, asmlinkage: Make dump_stack visible	2013-08-06 14:21:01 -07:00
dynamic_debug.c	dynamic debug: line queries failing due to uninitialized local variable	2013-08-28 12:10:53 -07:00
dynamic_queue_limits.c
earlycpio.c	earlycpio.c: Fix the confusing comment of find_cpio_data().	2013-08-14 23:24:01 +02:00
extable.c
fault-inject.c	debugfs: add get/set for atomic types	2013-06-03 13:55:01 -07:00
fdt.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
find_last_bit.c
find_next_bit.c
flex_array.c
flex_proportions.c
gcd.c
gen_crc32table.c
genalloc.c	lib/genalloc: add a helper function for DMA buffer allocation	2013-11-13 12:09:22 +09:00
halfmd4.c
hexdump.c	lib: introduce upper case hex ascii helpers	2013-09-20 15:38:26 -04:00
hweight.c
idr.c	idr: print a stack dump after ida_remove warning	2013-07-03 16:08:04 -07:00
inflate.c
int_sqrt.c	lib/int_sqrt.c: optimize square root algorithm	2013-04-29 18:28:19 -07:00
interval_tree.c	mm: interval tree updates	2012-10-09 16:22:40 +09:00
interval_tree_test_main.c	random32: rename random32 to prandom	2012-12-17 17:15:26 -08:00
iomap.c
iomap_copy.c
iommu-helper.c
ioremap.c
iovec.c	Hoist memcpy_fromiovec/memcpy_toiovec into lib/	2013-05-20 10:24:22 +09:30
irq_regs.c
is_single_threaded.c
jedec_ddr_data.c
kasprintf.c	lib/kasprintf.c: use kmalloc_track_caller() to get accurate traces for kvasprintf	2012-10-11 08:50:15 +09:00
Kconfig	lockref: use BLOATED_SPINLOCKS to avoid explicit config dependencies	2013-11-15 09:32:20 +09:00
Kconfig.debug	percpu: add test module for various percpu operations	2013-11-13 12:09:11 +09:00
Kconfig.kgdb	treewide: Fix typo in printk	2013-06-18 13:48:45 +02:00
Kconfig.kmemcheck
kfifo.c	kfifo: fix kfifo_alloc() and kfifo_init()	2013-02-27 19:10:23 -08:00
klist.c	klist: del waiter from klist_remove_waiters before wakeup waitting process	2013-05-21 10:16:39 -07:00
kobject.c	Revert "sysfs: drop kobj_ns_type handling"	2013-11-07 20:47:28 +09:00
kobject_uevent.c
kstrtox.c	kstrto*: add documentation	2012-12-17 17:15:22 -08:00
kstrtox.h
lcm.c
libcrc32c.c
list_debug.c
list_sort.c	lib/: rename random32() to prandom_u32()	2013-04-29 18:28:42 -07:00
llist.c	llist: fix/simplify llist_add() and llist_add_batch()	2013-07-13 13:29:24 +04:00
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c	sched: Introduce preempt_count accessor functions	2013-09-25 14:07:32 +02:00
lockref.c	lockref: use BLOATED_SPINLOCKS to avoid explicit config dependencies	2013-11-15 09:32:20 +09:00
lru_cache.c	lru_cache: introduce lc_get_cumulative()	2013-03-22 22:17:36 -06:00
Makefile	Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2013-11-14 16:30:30 +09:00
md5.c
memory-notifier-error-inject.c
memweight.c
net_utils.c	net: core: move mac_pton() to lib/net_utils.c	2013-06-05 12:00:27 -07:00
nlattr.c
notifier-error-inject.c	mode_t, whack-a-mole at 11...	2013-04-09 14:13:05 -04:00
notifier-error-inject.h
of-reconfig-notifier-error-inject.c	powerpc+of: Rename and fix OF reconfig notifier error inject module	2012-12-14 10:32:52 +11:00
oid_registry.c	Give the OID registry file module info to avoid kernel tainting	2013-05-05 14:38:00 -07:00
parser.c	lib/parser.c: fix up comments for valid return values from match_number	2013-02-21 17:22:25 -08:00
pci_iomap.c
percpu-refcount.c	percpu_refcount: export symbols	2013-10-16 21:35:53 -07:00
percpu_counter.c	percpu_counter: make APIs irq safe	2013-10-25 11:55:59 +01:00
percpu_ida.c	percpu_ida: add an API to return free tags	2013-10-25 11:56:00 +01:00
percpu_test.c	percpu: add test module for various percpu operations	2013-11-13 12:09:11 +09:00
plist.c
pm-notifier-error-inject.c
prio_heap.c
proportions.c
radix-tree.c	lib/radix-tree.c: make radix_tree_node_alloc() work correctly within interrupt	2013-09-11 15:59:36 -07:00
random32.c	random32: add test cases for taus113 implementation	2013-11-11 14:32:15 -05:00
ratelimit.c
rational.c
rbtree.c	rbtree: add postorder iteration functions	2013-09-11 15:59:19 -07:00
rbtree_test.c	rbtree_test: add test for postorder iteration	2013-09-11 15:59:20 -07:00
reciprocal_div.c
scatterlist.c	lib/scatterlist.c: don't flush_kernel_dcache_page on slab page	2013-10-31 16:58:13 -07:00
sha1.c
show_mem.c	mm: do not walk all of system memory during show_mem	2013-11-13 12:09:09 +09:00
smp_processor_id.c	sched: Introduce preempt_count accessor functions	2013-09-25 14:07:32 +02:00
sort.c
stmp_device.c
string.c
string_helpers.c	lib/string_helpers: introduce generic string_unescape	2013-04-30 17:04:03 -07:00
strncpy_from_user.c
strnlen_user.c
swiotlb.c	swiotlb: replace dma_length with sg_dma_len() macro	2013-08-09 11:28:42 -04:00
syscall.c
test-kstrtox.c
test-string_helpers.c	lib/string_helpers: introduce generic string_unescape	2013-04-30 17:04:03 -07:00
textsearch.c
timerqueue.c
ts_bm.c
ts_fsm.c
ts_kmp.c
ucs2_string.c	Move utf16 functions to kernel core and rename	2013-04-15 21:23:03 +01:00
usercopy.c	Kconfig: consolidate CONFIG_DEBUG_STRICT_USER_COPY_CHECKS	2013-04-30 17:04:09 -07:00
uuid.c	uuid: use prandom_bytes()	2013-04-29 18:28:42 -07:00
vsprintf.c	vsprintf: ignore %n again	2013-11-15 09:32:20 +09:00