linux-kernel - [PATCH 2/4] ACPI: sysfs: Fix a potential out-of-bound write in create_of

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <004a9aa85dcc37d112443e133c9edfd7624cd47b.1698081019.git.christophe.jaillet@wanadoo.fr>
Date:   Mon, 23 Oct 2023 21:33:16 +0200
From:   Christophe JAILLET <christophe.jaillet@...adoo.fr>
To:     rafael@...nel.org, lenb@...nel.org
Cc:     linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org,
        Christophe JAILLET <christophe.jaillet@...adoo.fr>
Subject: [PATCH 2/4] ACPI: sysfs: Fix a potential out-of-bound write in create_of_modalias()

The remaining size of the buffer used by snprintf() is not updated after
the first write, so subsequent write in the 'for' loop a few lines below
can write some data past the end of the 'modalias' buffer.

Correctly update the remaining size.

Note that this pattern is already correctly written in
create_pnp_modalias().

Fixes: 8765c5ba1949 ("ACPI / scan: Rework modalias creation when "compatible" is present")
Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
---
 drivers/acpi/device_sysfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
index 4deb36dccb73..7ec3142f3eda 100644
--- a/drivers/acpi/device_sysfs.c
+++ b/drivers/acpi/device_sysfs.c
@@ -215,6 +215,8 @@ static int create_of_modalias(const struct acpi_device *acpi_dev, char *modalias
 	if (len >= size)
 		return -ENOMEM;
 
+	size -= len;
+
 	of_compatible = acpi_dev->data.of_compatible;
 	if (of_compatible->type == ACPI_TYPE_PACKAGE) {
 		nval = of_compatible->package.count;
-- 
2.32.0