linux-kernel - Re: [PATCH] devfreq: add error check for sscanf in userspace governor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 Aug 2017 12:26:24 +0530
From:   Pavan Kondeti <pkondeti@...eaurora.org>
To:     Santosh Mardi <gsantosh@...eaurora.org>
Cc:     myungjoo.ham@...sung.com, kyungmin.park@...sung.com,
        rafael.j.wysocki@...el.com, cw00.choi@...sung.com,
        linux-pm@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
        gsantosh@....qualcomm.com, skannan@...cinc.com,
        rgottimu@....qualcomm.com
Subject: Re: [PATCH] devfreq: add error check for sscanf in userspace governor

Hi Santosh,

On Mon, Aug 7, 2017 at 6:36 PM, Santosh Mardi <gsantosh@...eaurora.org> wrote:
> store_freq function of devfreq userspace governor
> executes further, even if error is returned from sscanf,
> this will result in setting up wrong frequency value.
>
> Add proper error check to bail out if any error is returned.
>
> Signed-off-by: Santosh Mardi <gsantosh@...eaurora.org>
> ---
>  drivers/devfreq/governor_userspace.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/devfreq/governor_userspace.c b/drivers/devfreq/governor_userspace.c
> index 77028c2..1d0c9cc 100644
> --- a/drivers/devfreq/governor_userspace.c
> +++ b/drivers/devfreq/governor_userspace.c
> @@ -53,12 +53,15 @@ static ssize_t store_freq(struct device *dev, struct device_attribute *attr,
>         mutex_lock(&devfreq->lock);
>         data = devfreq->data;
>
> -       sscanf(buf, "%lu", &wanted);
> +       err = sscanf(buf, "%lu", &wanted);
> +       if (err != 1)
> +               goto out;

You can save this goto statement by moving this sscanf checking to
before taking the mutex.

>         data->user_frequency = wanted;
>         data->valid = true;
>         err = update_devfreq(devfreq);
>         if (err == 0)
>                 err = count;
> +out:
>         mutex_unlock(&devfreq->lock);
>         return err;
>  }
> --
> 1.9.1
>


-- 
Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a
Linux Foundation Collaborative Project