linux-kernel - Re: [PATCH] of/device: Fix of_device_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20170824172509.GE29306@minitux>
Date:   Thu, 24 Aug 2017 10:25:09 -0700
From:   Bjorn Andersson <bjorn.andersson@...aro.org>
To:     Rob Herring <robh+dt@...nel.org>
Cc:     Frank Rowand <frowand.list@...il.com>,
        "devicetree@...r.kernel.org" <devicetree@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] of/device: Fix of_device_get_modalias() buffer handling

On Thu 24 Aug 09:51 PDT 2017, Rob Herring wrote:

> On Wed, Aug 23, 2017 at 8:03 PM, Bjorn Andersson
> <bjorn.andersson@...aro.org> wrote:
[..]
> > @@ -206,12 +207,16 @@ static ssize_t of_device_get_modalias(struct device *dev, char *str, ssize_t len
> >         /* Name & Type */
> >         csize = snprintf(str, len, "of:N%sT%s", dev->of_node->name,
> >                          dev->of_node->type);
> > +       tsize = csize;
> >         len -= csize;
> > -       str += csize;
> > +       if (str)
> > +               str += csize;
> >
> >         of_property_for_each_string(dev->of_node, "compatible", p, compat) {
> > -               if (strlen(compat) + 2 > len)
> > -                       break;
> > +               csize = strlen(compat) + 1;
> > +               tsize += csize;
> > +               if (csize > len)
> > +                       continue;
> >
> >                 csize = snprintf(str, len, "C%s", compat);
> 
> We could just use the snprintf to give us the length. Something like
> this following the snprintf:
> 
> tsize +=csize;
> if (csize > len) {
>   if (len) {
>     str[0] = '\0';
>     len = 0;
>   }
>   continue;
> }
> 
> You'd need to prevent len from going negative up above too. It ends up
> being more lines but you save a strlen call. So perhaps it's fine as
> is, but since I've written it already throwing it out there...
> 

Indeed, I did attempt a few variants of this as well, but ended up
taking the cost of an extra strlen() to keep the complexity of the code
down.

Regards,
Bjorn