linux-kernel - Re: [tip:x86/cpu] x86/cpu: Strip any /proc/ cpuinfo model name field whitespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 27 May 2015 12:16:47 -0700
From:	Joe Perches <joe@...ches.com>
To:	Borislav Petkov <bp@...en8.de>
Cc:	luto@...capital.net, peterz@...radead.org, dvlasenk@...hat.com,
	torvalds@...ux-foundation.org, imammedo@...hat.com,
	brgerst@...il.com, mingo@...nel.org, prarit@...hat.com,
	dave.hansen@...ux.intel.com, fenghua.yu@...el.com, hpa@...or.com,
	linux-kernel@...r.kernel.org, tglx@...utronix.de, bp@...e.de,
	linux-tip-commits@...r.kernel.org
Subject: Re: [tip:x86/cpu] x86/cpu: Strip any /proc/ cpuinfo model name
 field whitespace

On Wed, 2015-05-27 at 21:06 +0200, Borislav Petkov wrote:
> On Wed, May 27, 2015 at 10:07:34AM -0700, Joe Perches wrote:
> > This code can memmove from beyond the x86_model_id field.
> 
> ... in the theoretical case where some model ID has more than 64 - 48
> preceding white spaces.
> 
> I guess we want to be prepared here for insane CPU model IDs coming from
> virtualization.
> 
> > Maybe:
> > 	char *model = strim(c->x86_model_id);
> > 	memmove(c->x86_model_id, model, strlen(model) + 1);
> 
> Yes, and additionally limit that string length:
> 
> ---
> diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
[]
> @@ -383,6 +383,9 @@ static const struct cpu_dev *cpu_devs[X86_VENDOR_NUM] = {};
>  static void get_model_name(struct cpuinfo_x86 *c)
>  {
>  	unsigned int *v;
> +	const char *model;
> +
> +#define MODEL_ID_MAXLEN 48
>  
>  	if (c->extended_cpuid_level < 0x80000004)
>  		return;
> @@ -391,13 +394,15 @@ static void get_model_name(struct cpuinfo_x86 *c)
>  	cpuid(0x80000002, &v[0], &v[1], &v[2], &v[3]);
>  	cpuid(0x80000003, &v[4], &v[5], &v[6], &v[7]);
>  	cpuid(0x80000004, &v[8], &v[9], &v[10], &v[11]);
> -	c->x86_model_id[48] = 0;
> +	c->x86_model_id[MODEL_ID_MAXLEN] = 0;
>  
>  	/*
>  	 * Remove leading whitespace on Intel processors and trailing
>  	 * whitespace on AMD processors.
>  	 */
> -	memmove(c->x86_model_id, strim(c->x86_model_id), 48);
> +	model = strim(c->x86_model_id);
> +
> +	memmove(c->x86_model_id, model, strnlen(model, MODEL_ID_MAXLEN) + 1);

I don't see any value in the #define or strnlen over strlen as
it's guaranteed terminated by the = 0 above, but <shrug> thanks.

cheers, Joe

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/