lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 23 Jul 2015 22:17:37 -0500 From: Alan Tull <delicious.quinoa@...il.com> To: Ricardo Ribalda Delgado <ricardo.ribalda@...il.com> Cc: Bryan Wu <cooloney@...il.com>, Richard Purdie <rpurdie@...ys.net>, linux-leds@...r.kernel.org, linux-kernel <linux-kernel@...r.kernel.org>, Geert Uytterhoeven <geert@...ux-m68k.org> Subject: Re: [PATCH 2/3] leds/class: Check snprintf return value On Mon, Mar 30, 2015 at 4:08 AM, Ricardo Ribalda Delgado <ricardo.ribalda@...il.com> wrote: > If the final name does not fit the string there is a potential > endless-loop. > > Reported-by: Geert Uytterhoeven <geert@...ux-m68k.org> > Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@...il.com> > --- > drivers/leds/led-class.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c > index 294d6d6..2ffe8b1 100644 > --- a/drivers/leds/led-class.c > +++ b/drivers/leds/led-class.c > @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char *init_name, char *name, > size_t len) > { > int i = 0; > + int ret = 0; > > strlcpy(name, init_name, len); > > - while (class_find_device(leds_class, NULL, name, match_name)) > + while (class_find_device(leds_class, NULL, name, match_name) && > + (ret < len)) > snprintf(name, len, "%s_%d", init_name, ++i); class_find_device will get a reference for a device. That reference must be dropped using put_device(). See the definition for class_find_device in drivers/base/class.c and other usage examples in the kernel. So this function call will only work the first time. Alan Tull > > + if (ret >= len) > + return -ENOMEM; > + > return i; > } > > @@ -243,6 +248,9 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev) > int ret; > > ret = led_classdev_next_name(led_cdev->name, name, sizeof(name)); > + if (ret < 0) > + return ret; > + > led_cdev->dev = device_create_with_groups(leds_class, parent, 0, > led_cdev, led_cdev->groups, "%s", name); > if (IS_ERR(led_cdev->dev)) > -- > 2.1.4 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@...r.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists