linux-kernel - [PATCH 3/3] x86: fix early command-line parsing when matching at end

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20151217215709.6148AC12@viggo.jf.intel.com>
Date:	Thu, 17 Dec 2015 13:57:09 -0800
From:	Dave Hansen <dave@...1.net>
To:	linux-kernel@...r.kernel.org
Cc:	Dave Hansen <dave@...1.net>, dave.hansen@...ux.intel.com,
	bp@...e.de, hpa@...or.com, fenghua.yu@...el.com,
	yu-cheng.yu@...el.com
Subject: [PATCH 3/3] x86: fix early command-line parsing when matching at end


From: Dave Hansen <dave.hansen@...ux.intel.com>

The x86 early command line parsing in cmdline_find_option_bool()
is buggy.  If it matches a specified 'option' all the way to
the end of the command-line, it will consider it a match.

For instance,

    	cmdline = "foo";
    	cmdline_find_option_bool(cmdline, "fool");

will return 1.  This is particularly annoying since we have
actual FPU options like "noxsave" and "noxsaves"  So,
command-line "foo bar noxsave" will match *BOTH* a "noxsave" and
"noxsaves". (This turns out not to be an actual problem because
"noxsave" implies "noxsaves", but it's still confusing.)

To fix this, we simplify the code and stop tracking 'len'.  'len'
was trying to indicate either the NULL terminator *OR* the end of
a non-NULL-terminated commandline at 'max_cmdline_size'.  But,
  each of the three states is *already* checking 'cmdline' for a
  NULL terminator.

We _only_ need to check if we have overrun 'max_cmdline_size', and
that we can do without keeping 'len' around.

Also add some commends to clarify what is going on.

Signed-off-by: Dave Hansen <dave.hansen@...ux.intel.com>
Cc: Borislav Petkov <bp@...e.de>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: linux-kernel@...r.kernel.org
Cc: fenghua.yu@...el.com
Cc: yu-cheng.yu@...el.com
---

 b/arch/x86/lib/cmdline.c |   34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff -puN arch/x86/lib/cmdline.c~x86-broken-end-of-string-command-line-parsing arch/x86/lib/cmdline.c
--- a/arch/x86/lib/cmdline.c~x86-broken-end-of-string-command-line-parsing	2015-12-17 13:54:53.398967308 -0800
+++ b/arch/x86/lib/cmdline.c	2015-12-17 13:54:53.401967444 -0800
@@ -22,13 +22,15 @@ static inline int myisspace(u8 c)
  * @option: option string to look for
  *
  * Returns the position of that @option (starts counting with 1)
- * or 0 on not found.
+ * or 0 on not found.  @option will only be found if it is found
+ * as an entire word in @cmdline.  For instance, if @option="car"
+ * then a cmdline which contains "cart" will not match.
  */
 static int __cmdline_find_option_bool(const char *cmdline,
 		int max_cmdline_size, const char *option)
 {
 	char c;
-	int len, pos = 0, wstart = 0;
+	int pos = 0, wstart = 0;
 	const char *opptr = NULL;
 	enum {
 		st_wordstart = 0,	/* Start of word/after whitespace */
@@ -39,11 +41,14 @@ static int __cmdline_find_option_bool(co
 	if (!cmdline)
 		return -1;      /* No command line */
 
-	len = min_t(int, strlen(cmdline), max_cmdline_size);
-	if (!len)
+	if (!strlen(cmdline))
 		return 0;
 
-	while (len--) {
+	/*
+	 * This 'pos' check ensures we do not overrun
+	 * a non-NULL-terminated 'cmdline'
+	 */
+	while (pos < max_cmdline_size) {
 		c = *(char *)cmdline++;
 		pos++;
 
@@ -60,17 +65,26 @@ static int __cmdline_find_option_bool(co
 			/* fall through */
 
 		case st_wordcmp:
-			if (!*opptr)
+			if (!*opptr) {
+				/*
+				 * We matched all the way to the end of the
+				 * option we were looking for.  If the
+				 * command-line has a space _or_ ends, then
+				 * we matched!
+				 */
 				if (!c || myisspace(c))
 					return wstart;
 				else
 					state = st_wordskip;
-			else if (!c)
+			} else if (!c) {
+				/*
+				 * Hit the NULL terminator on the end of
+				 * cmdline.
+				 */
 				return 0;
-			else if (c != *opptr++)
+			} else if (c != *opptr++) {
 				state = st_wordskip;
-			else if (!len)		/* last word and is matching */
-				return wstart;
+			}
 			break;
 
 		case st_wordskip:
_
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/