linux-kernel - Re: [PATCH 1/8] of: Fix modalias string generation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 2 Mar 2023 13:21:48 -0600
From:   Rob Herring <robh+dt@...nel.org>
To:     Miquel Raynal <miquel.raynal@...tlin.com>
Cc:     Srinivas Kandagatla <srinivas.kandagatla@...aro.org>,
        linux-kernel@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Michael Walle <michael@...le.cc>, devicetree@...r.kernel.org,
        Frank Rowand <frowand.list@...il.com>,
        Robert Marko <robert.marko@...tura.hr>,
        Luka Perkov <luka.perkov@...tura.hr>,
        Thomas Petazzoni <thomas.petazzoni@...tlin.com>,
        rafal@...ecki.pl, Stephen Boyd <stephen.boyd@...aro.org>,
        Peter Chen <peter.chen@....com>
Subject: Re: [PATCH 1/8] of: Fix modalias string generation

On Wed, Mar 1, 2023 at 9:22 AM Miquel Raynal <miquel.raynal@...tlin.com> wrote:
>
> The helper generating an OF based modalias (of_device_get_modalias())
> works fine, but due to the use of snprintf() internally it needs a
> buffer one byte longer than what should be needed just for the entire
> string (excluding the '\0'). Most users of this helper are sysfs hooks
> providing the modalias string to users. They all provide a PAGE_SIZE
> buffer which is way above the number of bytes required to fit the
> modalias string and hence do not suffer from this issue.
>
> There is another user though, of_device_request_module(), which is only
> called by drivers/usb/common/ulpi.c. This request module function is
> faulty, but maybe because in most cases there is an alternative, ULPI
> driver users have not noticed it.
>
> In this function, of_device_get_modalias() is called twice. The first
> time without buffer just to get the number of bytes required by the
> modalias string (excluding the null byte), and a second time, after
> buffer allocation, to fill the buffer. The allocation asks for an
> additional byte, in order to store the trailing '\0'. However, the
> buffer *length* provided to of_device_get_modalias() excludes this extra
> byte. The internal use of snprintf() with a length that is exactly the
> number of bytes to be written has the effect of using the last available
> byte to store a '\0', which then smashes the last character of the
> modalias string.
>
> Provide the actual size of the buffer to of_device_get_modalias() to fix
> this issue.
>
> Note: the "str[size - 1] = '\0';" line is not really needed as snprintf
> will anyway end the string with a null byte, but there is a possibility
> that this function might be called on a struct device_node without
> compatible, in this case snprintf() would not be executed. So we keep it
> just to avoid possible unbounded strings.
>
> Cc: Stephen Boyd <stephen.boyd@...aro.org>
> Cc: Peter Chen <peter.chen@....com>
> Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias")
> Signed-off-by: Miquel Raynal <miquel.raynal@...tlin.com>
> ---
>  drivers/of/device.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)

Ahh, an off by 2 error. ;)

Reviewed-by: Rob Herring <robh@...nel.org>