linux-kernel - Re: [PATCH v4 2/2] pinctrl: pinmux: Add pinmux-select debugfs file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHp75VeBbv8YzsnOsdXKOwPFd2WpjueCwMgm9mQPR2Xq4zW3QQ@mail.gmail.com>
Date:   Thu, 11 Feb 2021 11:53:24 +0200
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Geert Uytterhoeven <geert@...ux-m68k.org>
Cc:     Drew Fustini <drew@...gleboard.org>,
        Linus Walleij <linus.walleij@...aro.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Tony Lindgren <tony@...mide.com>,
        Alexandre Belloni <alexandre.belloni@...tlin.com>,
        Pantelis Antoniou <pantelis.antoniou@...sulko.com>,
        Jason Kridner <jkridner@...gleboard.org>,
        Robert Nelson <robertcnelson@...gleboard.org>,
        Joe Perches <joe@...ches.com>,
        Dan Carpenter <dan.carpenter@...cle.com>
Subject: Re: [PATCH v4 2/2] pinctrl: pinmux: Add pinmux-select debugfs file

On Thu, Feb 11, 2021 at 10:09 AM Geert Uytterhoeven
<geert@...ux-m68k.org> wrote:
> On Wed, Feb 10, 2021 at 11:33 PM Drew Fustini <drew@...gleboard.org> wrote:


> > +#define PINMUX_MAX_NAME 64

> > +       if (len > (PINMUX_MAX_NAME * 2)) {
> > +               dev_err(pctldev->dev, "write too big for buffer");
> > +               return -EINVAL;
> > +       }
> > +
> > +       buf = kzalloc(PINMUX_MAX_NAME * 2, GFP_KERNEL);

> > +       ret = strncpy_from_user(buf, user_buf, PINMUX_MAX_NAME * 2);
>
> While this guarantees buf is not overflowed...
>
> > +       if (ret < 0) {
> > +               dev_err(pctldev->dev, "failed to copy buffer from userspace");
> > +               goto free_gname;
> > +       }
> > +       buf[len-1] = '\0';
> > +
> > +       ret = sscanf(buf, "%s %s", fname, gname);
>
> ... one of the two strings can still be longer than PINMUX_MAX_NAME,
> thus overflowing fname or gname.
>
> As buf is already a copy, it may be easier to just find the strings in
> buf, write the NUL terminators into buf, and set up fname and gname
> to point to the strings inside buf.

You beat me up to it. I was about to comment the same.

So, indeed, instead of sscanf it's simply better and faster to do just
something like

fname = strstrip(buf) ;
if (*fname == '\0') {
  ...
  return -EINVAL;
}

gname = strchr(fname, ' ');
if (!gname) {
 ...
  return -EINVAL;
}
*gname++ = '\0';

on top of the buf pointer.

> > +       if (ret != 2) {
> > +               dev_err(pctldev->dev, "expected format: <function-name> <group-name>");
> > +               goto free_gname;
> > +       }



-- 
With Best Regards,
Andy Shevchenko