linux-kernel - Re: [PATCH] ntb_tool: Fix infinite loop bug when writing spad/peer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJ80satFd9z=tdgHSPJy_BKUXRGOfUV_Kc5_dgeaChsUF62h3Q@mail.gmail.com>
Date:	Sat, 28 May 2016 09:09:20 -0400
From:	Allen Hubbe <allenbh@...il.com>
To:	Logan Gunthorpe <logang@...tatee.com>
Cc:	Jon Mason <jdmason@...zu.us>, Dave Jiang <dave.jiang@...el.com>,
	linux-ntb@...glegroups.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ntb_tool: Fix infinite loop bug when writing
 spad/peer_spad file

On Fri, May 27, 2016 at 4:38 PM, Logan Gunthorpe <logang@...tatee.com> wrote:
> If you tried to write two spads in one line, as per the example:
>
> root@...r# echo '0 0x01010101 1 0x7f7f7f7f' > $DBG_DIR/peer_spad
>
> then the CPU would freeze in an infinite loop.
>
> This wasn't immediately obvious but 'pos' was not incrementing the
> buffer, so after reading the second pair of values, 'pos' would once
> again be 3 and it would re-read the second pair of values ad infinitum.
>
> Signed-off-by: Logan Gunthorpe <logang@...tatee.com>

Good catch.  Thanks Logan.

Acked-by: Allen Hubbe <Allen.Hubbe@....com>

> ---
>  drivers/ntb/test/ntb_tool.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
> index 6f5dc6c..209ef7c 100644
> --- a/drivers/ntb/test/ntb_tool.c
> +++ b/drivers/ntb/test/ntb_tool.c
> @@ -268,7 +268,7 @@ static ssize_t tool_spadfn_write(struct tool_ctx *tc,
>  {
>         int spad_idx;
>         u32 spad_val;
> -       char *buf;
> +       char *buf, *buf_ptr;
>         int pos, n;
>         ssize_t rc;
>
> @@ -288,14 +288,15 @@ static ssize_t tool_spadfn_write(struct tool_ctx *tc,
>         }
>
>         buf[size] = 0;
> -
> -       n = sscanf(buf, "%d %i%n", &spad_idx, &spad_val, &pos);
> +       buf_ptr = buf;
> +       n = sscanf(buf_ptr, "%d %i%n", &spad_idx, &spad_val, &pos);
>         while (n == 2) {
> +               buf_ptr += pos;
>                 rc = spad_write_fn(tc->ntb, spad_idx, spad_val);
>                 if (rc)
>                         break;
>
> -               n = sscanf(buf + pos, "%d %i%n", &spad_idx, &spad_val, &pos);
> +               n = sscanf(buf_ptr, "%d %i%n", &spad_idx, &spad_val, &pos);
>         }
>
>         if (n < 0)
> --
> 2.1.4