linux-kernel - Re: [PATCH] usbip: fix usbip bind writing random string after command in match

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 15 Dec 2017 10:39:37 -0700
From:   Shuah Khan <shuahkh@....samsung.com>
To:     Juan Zea <juan.zea@...del.com>, linux-usb@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     shuah@...nel.org, Valentina Manea <valentina.manea.m@...il.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usbip: fix usbip bind writing random string after command
 in match_busid

On 12/15/2017 02:21 AM, Juan Zea wrote:
> usbip bind writes commands followed by random string when writing to
> match_busid attribute in sysfs, caused by using full variable size
> instead of string length.
> 
> Signed-off-by: Juan Zea <juan.zea@...del.com>
> ---
>  tools/usb/usbip/src/utils.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c
> index 2b3d6d2..3d7b42e 100644
> --- a/tools/usb/usbip/src/utils.c
> +++ b/tools/usb/usbip/src/utils.c
> @@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add)
>  	char command[SYSFS_BUS_ID_SIZE + 4];
>  	char match_busid_attr_path[SYSFS_PATH_MAX];
>  	int rc;
> +	int cmd_size;
>  
>  	snprintf(match_busid_attr_path, sizeof(match_busid_attr_path),
>  		 "%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME,
> @@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add)
>  		 attr_name);
>  
>  	if (add)
> -		snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid);
> +		cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s",
> +				    busid);
>  	else
> -		snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid);
> +		cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s",
> +				    busid);
>  
>  	rc = write_sysfs_attribute(match_busid_attr_path, command,
> -				   sizeof(command));
> +				   cmd_size);
>  	if (rc < 0) {
>  		dbg("failed to write match_busid: %s", strerror(errno));
>  		return -1;
> 

Thanks for the patch.

Greg, could you please pick this up.

Acked-by: Shuah Khan <shuahkh@....samsung.com>

-- Shuah