linux-kernel - Re: [PATCH v2] EDAC/mc_sysfs: Add missing newlines when printing {max,dimm}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Sep 2020 19:00:52 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Xiongfeng Wang <wangxiongfeng2@...wei.com>
Cc:     mchehab@...nel.org, tony.luck@...el.com,
        linux-edac@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] EDAC/mc_sysfs: Add missing newlines when printing
 {max,dimm}_location

On Mon, Sep 14, 2020 at 10:48:54AM +0800, Xiongfeng Wang wrote:
> @@ -813,15 +817,21 @@ static ssize_t mci_max_location_show(struct device *dev,
>  				     char *data)
>  {
>  	struct mem_ctl_info *mci = to_mci(dev);
> -	int i;
> +	int i, n;
>  	char *p = data;
> +	unsigned int len = PAGE_SIZE;
>  
>  	for (i = 0; i < mci->n_layers; i++) {
> -		p += sprintf(p, "%s %d ",
> +		n = snprintf(p, len, "%s %d ",
>  			     edac_layer_name[mci->layers[i].type],
>  			     mci->layers[i].size - 1);
> +		p += n;
> +		len -= n;

What happens if that subtraction causes len to wrap around and become a
huge positive unsigned integer?

> +		if (!len)

Would that test still work?

IOW, I did this to your patch ontop. Note that I've moved the "p"
pointer incrementation after the length check so that the pointer
doesn't overflow too:

---
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index bf0e075fb635..fa0551c81e63 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -817,19 +817,22 @@ static ssize_t mci_max_location_show(struct device *dev,
 				     char *data)
 {
 	struct mem_ctl_info *mci = to_mci(dev);
-	int i, n;
+	int len = PAGE_SIZE;
 	char *p = data;
-	unsigned int len = PAGE_SIZE;
+	int i, n;
 
 	for (i = 0; i < mci->n_layers; i++) {
 		n = snprintf(p, len, "%s %d ",
 			     edac_layer_name[mci->layers[i].type],
 			     mci->layers[i].size - 1);
-		p += n;
+
 		len -= n;
-		if (!len)
+		if (len < 0)
 			goto out;
+
+		p += n;
 	}
+
 	p += snprintf(p, len, "\n");
 out:
 	return p - data;

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette