linux-kernel - Re: [PATCH] dell-smbios: fix string overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 8 Nov 2017 21:03:09 +0200
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Mario Limonciello <Mario.Limonciello@...l.com>
Cc:     Kuppuswamy Sathyanarayanan 
        <sathyanarayanan.kuppuswamy@...ux.intel.com>,
        Arnd Bergmann <arnd@...db.de>,
        Pali Rohár <pali.rohar@...il.com>,
        "dvhart@...radead.org" <dvhart@...radead.org>,
        Andy Shevchenko <andy@...radead.org>, quasisec@...gle.com,
        Hans de Goede <hdegoede@...hat.com>,
        Platform Driver <platform-driver-x86@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] dell-smbios: fix string overflow

On Wed, Nov 8, 2017 at 8:30 PM,  <Mario.Limonciello@...l.com> wrote:

>> I recommend using "platform/x86: dell-smbios:" in commit header.

While we (maintainers) are fixing this manually, it would be better if
contributors will do this themselves :-)

>> On 11/08/2017 04:08 AM, Arnd Bergmann wrote:
>> > The new sysfs code overwrites two fixed-length character arrays
>> > that are each one byte shorter than they need to be, to hold
>> > the trailing \0:
>> >
>> > drivers/platform/x86/dell-smbios.c: In function 'build_tokens_sysfs':
>> > drivers/platform/x86/dell-smbios.c:494:42: error: 'sprintf' writing a terminating
>> nul past the end of the destination [-Werror=format-overflow=]
>> >     sprintf(buffer_location, "%04x_location",
>> > drivers/platform/x86/dell-smbios.c:494:3: note: 'sprintf' output 14 bytes into a
>> destination of size 13
>> > drivers/platform/x86/dell-smbios.c:506:36: error: 'sprintf' writing a terminating
>> nul past the end of the destination [-Werror=format-overflow=]
>> >     sprintf(buffer_value, "%04x_value",
>> > drivers/platform/x86/dell-smbios.c:506:3: note: 'sprintf' output 11 bytes into a
>> destination of size 10
>> Don't need to include the error log in commit message. Just explaining
>> the issue is good enough.
>> >
>> > This changes it to just use kasprintf(), which always gets it right.

Good catch followed by a fix!

> Assuming Darren will do the fixup for title and message as recommended by
> Sathyanarayanan before committing:
> Acked-by: Mario Limonciello <mario.limonciello@...l.com>

> Thanks, for the fix.  For my own information and improvement, would you
> share how you caught that?  Just added "-Werror=format-overflow=" to CFLAGS?

> I wasn't seeing the compile errors with default flags in my own testing, so I'd like
> to make sure I'm doing better testing in the future.

gcc7 by its default [1], though you need to revert [2].

And always good to remember

% make W=1

which implies some warning, W=2 a lot more.

[1]: http://patches.linaro.org/cover/107779/

[2]: commit bd664f6b3e376a8ef4990f87d08271cc2d01ba9a
Author: Linus Torvalds <torvalds@...ux-foundation.org>
Date:   Wed Jul 12 19:25:47 2017 -0700

   disable new gcc-7.1.1 warnings for now


-- 
With Best Regards,
Andy Shevchenko