linux-kernel - Re: [PATCH v4 1/3] platform/mellanox: mlxbf-pmc: Fix potential buffer overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <97f90ed6-e857-8b66-a4b8-8ed580bb18c7@redhat.com>
Date:   Mon, 11 Sep 2023 13:14:33 +0200
From:   Hans de Goede <hdegoede@...hat.com>
To:     Shravan Kumar Ramani <shravankr@...dia.com>,
        Mark Gross <markgross@...nel.org>,
        Vadim Pasternak <vadimp@...dia.com>,
        David Thompson <davthompson@...dia.com>
Cc:     platform-driver-x86@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4 1/3] platform/mellanox: mlxbf-pmc: Fix potential buffer
 overflows

Hi,

On 9/5/23 14:49, Shravan Kumar Ramani wrote:
> Replace sprintf with sysfs_emit where possible.
> Size check in mlxbf_pmc_event_list_show should account for "\0".
> 
> Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver")
> Signed-off-by: Shravan Kumar Ramani <shravankr@...dia.com>
> Reviewed-by: Vadim Pasternak <vadimp@...dia.com>
> Reviewed-by: David Thompson <davthompson@...dia.com>

Thank you for your patch, I've applied this patch to my fixes
branch:
https://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86.git/log/?h=fixes

Note it will show up in my fixes branch once I've pushed my
local branch there, which might take a while.

I will include this patch in my next fixes pull-req to Linus
for the current kernel development cycle.

Regards,

Hans

> ---
>  drivers/platform/mellanox/mlxbf-pmc.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c
> index be967d797c28..95afcae7b9fa 100644
> --- a/drivers/platform/mellanox/mlxbf-pmc.c
> +++ b/drivers/platform/mellanox/mlxbf-pmc.c
> @@ -1008,7 +1008,7 @@ static ssize_t mlxbf_pmc_counter_show(struct device *dev,
>  	} else
>  		return -EINVAL;
>  
> -	return sprintf(buf, "0x%llx\n", value);
> +	return sysfs_emit(buf, "0x%llx\n", value);
>  }
>  
>  /* Store function for "counter" sysfs files */
> @@ -1078,13 +1078,13 @@ static ssize_t mlxbf_pmc_event_show(struct device *dev,
>  
>  	err = mlxbf_pmc_read_event(blk_num, cnt_num, is_l3, &evt_num);
>  	if (err)
> -		return sprintf(buf, "No event being monitored\n");
> +		return sysfs_emit(buf, "No event being monitored\n");
>  
>  	evt_name = mlxbf_pmc_get_event_name(pmc->block_name[blk_num], evt_num);
>  	if (!evt_name)
>  		return -EINVAL;
>  
> -	return sprintf(buf, "0x%llx: %s\n", evt_num, evt_name);
> +	return sysfs_emit(buf, "0x%llx: %s\n", evt_num, evt_name);
>  }
>  
>  /* Store function for "event" sysfs files */
> @@ -1139,9 +1139,9 @@ static ssize_t mlxbf_pmc_event_list_show(struct device *dev,
>  		return -EINVAL;
>  
>  	for (i = 0, buf[0] = '\0'; i < size; ++i) {
> -		len += sprintf(e_info, "0x%x: %s\n", events[i].evt_num,
> -			       events[i].evt_name);
> -		if (len > PAGE_SIZE)
> +		len += snprintf(e_info, sizeof(e_info), "0x%x: %s\n",
> +				events[i].evt_num, events[i].evt_name);
> +		if (len >= PAGE_SIZE)
>  			break;
>  		strcat(buf, e_info);
>  		ret = len;
> @@ -1168,7 +1168,7 @@ static ssize_t mlxbf_pmc_enable_show(struct device *dev,
>  
>  	value = FIELD_GET(MLXBF_PMC_L3C_PERF_CNT_CFG_EN, perfcnt_cfg);
>  
> -	return sprintf(buf, "%d\n", value);
> +	return sysfs_emit(buf, "%d\n", value);
>  }
>  
>  /* Store function for "enable" sysfs files - only for l3cache */