linux-kernel - Re: [PATCH v2 3/4] pwm: sysfs: Replace sprintf() with sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 28 Sep 2022 17:20:07 +0200
From:   Thierry Reding <thierry.reding@...il.com>
To:     Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Cc:     linux-pwm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Uwe Kleine-König 
        <u.kleine-koenig@...gutronix.de>
Subject: Re: [PATCH v2 3/4] pwm: sysfs: Replace sprintf() with sysfs_emit()

On Wed, Sep 28, 2022 at 04:58:17PM +0300, Andy Shevchenko wrote:
> On Wed, Sep 28, 2022 at 04:40:35PM +0300, Andy Shevchenko wrote:
> > On Wed, Sep 28, 2022 at 02:28:41PM +0200, Thierry Reding wrote:
> > > On Fri, Aug 26, 2022 at 08:07:15PM +0300, Andy Shevchenko wrote:
> > > > For sysfs outputs, it's safer to use a new helper, sysfs_emit(),
> > > > instead of the raw sprintf() & co. This patch replaces such a
> > > > sprintf() call straightforwardly with the new helper.
> > 
> > > How exactly is sysfs_emit() safer here? In all of these cases, the
> > > values that sprintf() writes are the only values that are written into
> > > the buffer and we know that none of them exceed PAGE_SIZE. So the
> > > additional checks that sysfs_emit() performs are useless.
> > 
> > This is a recommended way to use sysfs_emit() mentioned in Documentation.
> > Care to fix documentation?
> 
> For your convenience, Documentation/filesystems/sysfs.rst says:
> 
> - show() should only use sysfs_emit() or sysfs_emit_at() when formatting
>   the value to be returned to user space.

Took some digging to find enough information to convince me. Again, the
commit message says that sysfs_emit() is safer, but that's a bad reason
in this case because these cases are fine. The sprintf() calls that this
replaces aren't unbound and we're not appending to an existing seq_buf,
so nothing to worry on that front.

I think the better argument for broadly applying this is to specifically
distinguish the sysfs sprintf() calls from others so that they can be
auditioned better and perhaps help with the documentation[0].

Do you mind if I apply this with a reworded documentation?

Thierry

[0]: https://lore.kernel.org/all/20200930115740.GA1611809@kroah.com/

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)