linux-kernel - Re: [PATCH] uacce: use sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YKJZ8278k0GEcF87@kroah.com>
Date:   Mon, 17 May 2021 13:56:35 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     "yekai(A)" <yekai13@...wei.com>
Cc:     linux-accelerators@...ts.ozlabs.org, linux-kernel@...r.kernel.org,
        linuxarm@...wei.com, zhangfei.gao@...aro.org,
        wangzhou1@...ilicon.com
Subject: Re: [PATCH] uacce: use sysfs_emit instead of sprintf

On Mon, May 17, 2021 at 07:49:37PM +0800, yekai(A) wrote:
> 
> 
> On 2021/5/17 18:36, Greg KH wrote:
> > On Mon, May 17, 2021 at 06:25:37PM +0800, Kai Ye wrote:
> > > Use the sysfs_emit to replace sprintf.
> > 
> > That says _what_ you did, not _why_ you are doing this.  What problem
> > are you solving with this change?
> > 
> > thanks,
> > 
> > greg k-h
> > .
> > 
> sprintf is not safe, and it not recommended to use.

Why not?  What is "unsafe" with it in this function?

> sprintf does not know the PAGE_SIZE maximum of the temporary buffer
> used for outputting sysfs content and it's possible to overrun the
> PAGE_SIZE buffer length. so used sysfs_emit that  knows that the size
> of the call situations that also ensures that no overrun is done. so use
> sysfs_emit to replace sprintf maybe better.

But that's not a problem at all for these calls, right?  If so, please
show me how that could ever happen.

thanks,

greg k-h