linux-kernel - Re: [PATCH v2] EDAC/mc_sysfs: Add missing newlines when printing {max,dimm}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <591e613e-0b53-028f-08fd-3d62a35b8c4f@huawei.com>
Date:   Thu, 17 Sep 2020 19:38:57 +0800
From:   Xiongfeng Wang <wangxiongfeng2@...wei.com>
To:     Borislav Petkov <bp@...en8.de>
CC:     <mchehab@...nel.org>, <tony.luck@...el.com>,
        <linux-edac@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] EDAC/mc_sysfs: Add missing newlines when printing
 {max,dimm}_location

Hi ,

On 2020/9/17 1:00, Borislav Petkov wrote:
> On Mon, Sep 14, 2020 at 10:48:54AM +0800, Xiongfeng Wang wrote:
>> @@ -813,15 +817,21 @@ static ssize_t mci_max_location_show(struct device *dev,
>>  				     char *data)
>>  {
>>  	struct mem_ctl_info *mci = to_mci(dev);
>> -	int i;
>> +	int i, n;
>>  	char *p = data;
>> +	unsigned int len = PAGE_SIZE;
>>  
>>  	for (i = 0; i < mci->n_layers; i++) {
>> -		p += sprintf(p, "%s %d ",
>> +		n = snprintf(p, len, "%s %d ",
>>  			     edac_layer_name[mci->layers[i].type],
>>  			     mci->layers[i].size - 1);
>> +		p += n;
>> +		len -= n;
> 
> What happens if that subtraction causes len to wrap around and become a
> huge positive unsigned integer?
> 
>> +		if (!len)
> 
> Would that test still work?

I am not sure if snprintf will return a value larger than its second input
paramter 'size'. But we can also check if 'len' is less than 0. It's better.

> 
> IOW, I did this to your patch ontop. Note that I've moved the "p"
> pointer incrementation after the length check so that the pointer
> doesn't overflow too:

Thanks. I will add it in the next version.

> 
> ---
> diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
> index bf0e075fb635..fa0551c81e63 100644
> --- a/drivers/edac/edac_mc_sysfs.c
> +++ b/drivers/edac/edac_mc_sysfs.c
> @@ -817,19 +817,22 @@ static ssize_t mci_max_location_show(struct device *dev,
>  				     char *data)
>  {
>  	struct mem_ctl_info *mci = to_mci(dev);
> -	int i, n;
> +	int len = PAGE_SIZE;
>  	char *p = data;
> -	unsigned int len = PAGE_SIZE;
> +	int i, n;
>  
>  	for (i = 0; i < mci->n_layers; i++) {
>  		n = snprintf(p, len, "%s %d ",
>  			     edac_layer_name[mci->layers[i].type],
>  			     mci->layers[i].size - 1);
> -		p += n;
> +
>  		len -= n;
> -		if (!len)
> +		if (len < 0)

Not sure whether we need to check 'len' equals to 0.
if (len <= 0) ?


>  			goto out;
> +
> +		p += n;
>  	}
> +
>  	p += snprintf(p, len, "\n");
>  out:
>  	return p - data;
> 

Thanks,
XIongfeng