linux-kernel - [PATCH -next] cpufreq: Fix reserved space in cpufreq_show

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 21 May 2022 14:35:34 +0800
From:   Yi Yang <yiyang13@...wei.com>
To:     <rafael@...nel.org>, <viresh.kumar@...aro.org>
CC:     <linux-pm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <yiyang13@...wei.com>
Subject: [PATCH -next] cpufreq: Fix reserved space in cpufreq_show_cpus()

Function scnprintf() would reserve space for the trailing '\0' and return 
value is the number of characters written into buf not including the 
trailing '\0'. internally meaning the next scnprintf() would write begin 
the trailing '\0'. The code specifying "PAGE_SIZE - i - 2" here is trying 
to reserve space for "\n\0" which would cause scnprintf() to reserve an 
additional byte making the tail of the buf looks like this: "\n\0\0". 
Thus. we should reserve only the space for one '\0'. passing in 
"PAGE_SIZE - i - 1".

Additionally, each iteration would replace the trailing '\0' from the last 
iteration with a space, and append 4 additional bytes to the string making 
it a total of 5 additional bytes. That means we should stop printing into 
the buffer if the remaining size is less than 7 bytes(1 for the ' ', 4 for 
the %u and 2 for the tailing "\n\0")

Signed-off-by: Yi Yang <yiyang13@...wei.com>
---
 drivers/cpufreq/cpufreq.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 1f6667ce43bd..60c005c9961e 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -844,9 +844,9 @@ ssize_t cpufreq_show_cpus(const struct cpumask *mask, char *buf)

 	for_each_cpu(cpu, mask) {
 		if (i)
-			i += scnprintf(&buf[i], (PAGE_SIZE - i - 2), " ");
-		i += scnprintf(&buf[i], (PAGE_SIZE - i - 2), "%u", cpu);
-		if (i >= (PAGE_SIZE - 5))
+			i += scnprintf(&buf[i], (PAGE_SIZE - i - 1), " ");
+		i += scnprintf(&buf[i], (PAGE_SIZE - i - 1), "%u", cpu);
+		if (i >= (PAGE_SIZE - 6))
 			break;
 	}
 	i += sprintf(&buf[i], "\n");
-- 
2.17.1