Handle failed report time formatting

format_fs_error_time returned the caller buffer even when the size check rejected it. That let report code pass an uninitialized buffer to fprintf when an undersized destination was supplied, and the same returned-buffer pattern existed in related report time formatters added to the access-attribute audit.

The affected formatters now return NULL when the destination buffer cannot be initialized, and each report caller substitutes unavailable before printing. The return-value comments now document the NULL result so future callers do not treat it as a valid string.

Author: stevegrubb

src/daemon/fanotify-fs-error.c

@@ -168,15 +168,15 @@ static const char *fs_error_code_text(int error)
  * @when: timestamp saved with the error details.
  * @buf: destination buffer.
  * @buf_size: destination size.
- * Returns @buf.
+ * Returns @buf on success, or NULL when @buf cannot be initialized.
  */
 static const char *format_fs_error_time(time_t when, char *buf,
 					size_t buf_size)
 {
 	struct tm tm;
 
-	if (buf_size < 11)
-		return buf;
+	if (buf == NULL || buf_size < 11)
+		return NULL;
 
 	if (when == 0) {
 		strncpy(buf, "never", buf_size - 1);
@@ -347,6 +347,7 @@ static void record_fs_error_event(
 void fanotify_fs_error_report(FILE *f)
 {
 	struct fanotify_fs_error_details details;
+	const char *when_text;
 	char when[64];
 
 	if (f == NULL)
@@ -358,8 +359,11 @@ void fanotify_fs_error_report(FILE *f)
 
 	fprintf(f, "Filesystem error last status: %s\n",
 		fs_error_status(&details));
+	when_text = format_fs_error_time(details.when, when, sizeof(when));
+	if (when_text == NULL)
+		when_text = "unavailable";
 	fprintf(f, "Filesystem error last seen: %s\n",
-		format_fs_error_time(details.when, when, sizeof(when)));
+		when_text);
 	if (!details.valid)
 		return;
 

src/daemon/state-report.c

@@ -115,14 +115,14 @@ void usr1_handler(int sig __attribute__((unused)),
  * format_metrics_reset_time - format the last metric reset timestamp.
  * @buf: destination buffer.
  * @buf_size: destination size.
- * Returns @buf.
+ * Returns @buf on success, or NULL when @buf cannot be initialized.
  */
 static const char *format_metrics_reset_time(char *buf, size_t buf_size)
 {
 	struct tm tm;
 
-	if (buf_size == 0)
-		return buf;
+	if (buf == NULL || buf_size == 0)
+		return NULL;
 
 	if (last_metrics_reset == 0) {
 		strncpy(buf, "never", buf_size - 1);
@@ -253,15 +253,19 @@ void decision_report_reset(FILE *f, int reset)
 void decision_report_metrics_reset(FILE *f, int reset)
 {
 	decision_metrics_t metrics;
+	const char *reset_text;
 	char reset_time[64];
 
 	if (f == NULL)
 		return;
 
 	getDecisionMetricsReset(&metrics, reset);
 
+	reset_text = format_metrics_reset_time(reset_time, sizeof(reset_time));
+	if (reset_text == NULL)
+		reset_text = "unavailable";
 	fprintf(f, "Last metrics reset: %s\n",
-		format_metrics_reset_time(reset_time, sizeof(reset_time)));
+		reset_text);
 	fprintf(f, "Ruleset generation: %u\n", metrics.ruleset_generation);
 
 	fprintf(f, "\nDecision outcomes:\n");

src/library/decision-timing.c

@@ -492,13 +492,16 @@ static int open_timing_report(void)
  * @when: timestamp to format.
  * @buf: destination buffer.
  * @buf_len: size of @buf.
- * Returns @buf.
+ * Returns @buf on success, or NULL when @buf cannot be initialized.
  */
 static const char *format_report_time(long when, char *buf, size_t buf_len)
 {
 	struct tm tm;
 	time_t t = (time_t)when;
 
+	if (buf == NULL || buf_len == 0)
+		return NULL;
+
 	if (when <= 0) {
 		strncpy(buf, "never", buf_len - 1);
 		buf[buf_len - 1] = 0;
@@ -2276,6 +2279,7 @@ static void write_timing_report(const conf_t *config)
 	FILE *f;
 	unsigned int worker, stage, worker_count;
 	char decisions[32], duration[32], start_time[64], stop_time[64];
+	const char *start_text, *stop_text;
 	const char *mode = decision_timing_mode_name(
 		config_timing_mode(config));
 	unsigned long long duration_ns = 0;
@@ -2339,11 +2343,16 @@ static void write_timing_report(const conf_t *config)
 
 	format_count(decision_count, decisions, sizeof(decisions));
 	format_hms_duration(duration_ns, duration, sizeof(duration));
+	start_text = format_report_time(started, start_time,
+					sizeof(start_time));
+	if (start_text == NULL)
+		start_text = "unavailable";
+	stop_text = format_report_time(stopped, stop_time, sizeof(stop_time));
+	if (stop_text == NULL)
+		stop_text = "unavailable";
 
 	fprintf(f, "Mode: %s\n", mode);
-	fprintf(f, "Timing run: %s to %s\n",
-		format_report_time(started, start_time, sizeof(start_time)),
-		format_report_time(stopped, stop_time, sizeof(stop_time)));
+	fprintf(f, "Timing run: %s to %s\n", start_text, stop_text);
 	fprintf(f, "Duration: %s\n", duration);
 	fprintf(f, "Workers: %u\n", worker_count);
 	fprintf(f, "Max queue depth: %u\n", max_queue_depth);
@@ -2679,17 +2688,22 @@ void decision_timing_control_report(FILE *f, const conf_t *config)
  */
 void decision_timing_history_report(FILE *f)
 {
+	const char *arm_text, *stop_text;
 	char arm_time[64], stop_time[64];
 
 	if (f == NULL)
 		return;
 
-	fprintf(f, "Timing collection last start time: %s\n",
-		format_report_time(atomic_load_explicit(&last_arm_time,
-			memory_order_relaxed), arm_time, sizeof(arm_time)));
-	fprintf(f, "Timing collection last stop time: %s\n",
-		format_report_time(atomic_load_explicit(&last_stop_time,
-			memory_order_relaxed), stop_time, sizeof(stop_time)));
+	arm_text = format_report_time(atomic_load_explicit(&last_arm_time,
+			memory_order_relaxed), arm_time, sizeof(arm_time));
+	if (arm_text == NULL)
+		arm_text = "unavailable";
+	stop_text = format_report_time(atomic_load_explicit(&last_stop_time,
+			memory_order_relaxed), stop_time, sizeof(stop_time));
+	if (stop_text == NULL)
+		stop_text = "unavailable";
+	fprintf(f, "Timing collection last start time: %s\n", arm_text);
+	fprintf(f, "Timing collection last stop time: %s\n", stop_text);
 }
 
 /*