linux-kernel - Re: More checks for patterns? was: Fix pattern handling optimalization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 26 Oct 2018 16:02:10 +0800
From:   Baolin Wang <baolin.wang@...aro.org>
To:     Pavel Machek <pavel@....cz>
Cc:     Jacek Anaszewski <jacek.anaszewski@...il.com>,
        rteysseyre@...il.com, Bjorn Andersson <bjorn.andersson@...aro.org>,
        Mark Brown <broonie@...nel.org>,
        Linus Walleij <linus.walleij@...aro.org>,
        Linux LED Subsystem <linux-leds@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: More checks for patterns? was: Fix pattern handling optimalization

Hi Pavel,

On 26 October 2018 at 05:24, Pavel Machek <pavel@....cz> wrote:
>
> We don't want brightness < 0, but this may not be best way to do
> this. We also don't want brightness > max_brightness, but I'm not sure
> this check is effective.

I think this is reasonable, but we can simplify the patch as:

diff --git a/drivers/leds/trigger/ledtrig-pattern.c
b/drivers/leds/trigger/ledtrig-pattern.c
index ce7acd1..3a4ecb9 100644
--- a/drivers/leds/trigger/ledtrig-pattern.c
+++ b/drivers/leds/trigger/ledtrig-pattern.c
@@ -250,10 +250,11 @@ static ssize_t
pattern_trig_store_patterns(struct led_classdev *led_cdev,

        while (offset < count - 1 && data->npatterns < MAX_PATTERNS) {
                cr = 0;
-               ccount = sscanf(buf + offset, "%d %u %n",
+               ccount = sscanf(buf + offset, "%u %u %n",
                                &data->patterns[data->npatterns].brightness,
                                &data->patterns[data->npatterns].delta_t, &cr);
-               if (ccount != 2) {
+               if (ccount != 2 ||
+                   data->patterns[data->npatterns].brightness >
data->led_cdev->max_brightness) {
                        data->npatterns = 0;
                        err = -EINVAL;
                        goto out;

>
> We probably also don't want pattern where all the delta_t s are zero.

Yes. Maybe add one function to valid the patterns.

>
> I came up with this so far....
>                                                             Pavel
>
>
>
> diff --git a/drivers/leds/trigger/ledtrig-pattern.c b/drivers/leds/trigger/ledtrig-pattern.c
> index ce7acd1..bc5f495 100644
> --- a/drivers/leds/trigger/ledtrig-pattern.c
> +++ b/drivers/leds/trigger/ledtrig-pattern.c
> @@ -250,9 +251,16 @@ static ssize_t pattern_trig_store_patterns(struct led_classdev *led_cdev,
>
>         while (offset < count - 1 && data->npatterns < MAX_PATTERNS) {
>                 cr = 0;
> -               ccount = sscanf(buf + offset, "%d %u %n",
> +               ccount = sscanf(buf + offset, "%u %u %n",
>                                 &data->patterns[data->npatterns].brightness,
>                                 &data->patterns[data->npatterns].delta_t, &cr);
> +
> +               if (data->patterns[data->npatterns].brightness > data->led_cdev->max_brightness) {
> +                       data->npatterns = 0;
> +                       err = -EINVAL;
> +                       goto out;
> +               }
> +
>                 if (ccount != 2) {
>                         data->npatterns = 0;
>                         err = -EINVAL;
>
>
>
>
> --
> (english) http://www.livejournal.com/~pavelmachek
> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html



-- 
Baolin Wang
Best Regards