[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJZ5v0gzV+nX+dSEShAopkcvx1Zx2Rc2=pjcdH07U9nQhHRe4Q@mail.gmail.com>
Date: Tue, 24 Oct 2023 22:03:35 +0200
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Christian Marangi <ansuelsmth@...il.com>
Cc: "Rafael J. Wysocki" <rafael@...nel.org>,
Viresh Kumar <viresh.kumar@...aro.org>,
MyungJoo Ham <myungjoo.ham@...sung.com>,
Kyungmin Park <kyungmin.park@...sung.com>,
Chanwoo Choi <cw00.choi@...sung.com>,
Takashi Iwai <tiwai@...e.de>,
Jonghwa Lee <jonghwa3.lee@...sung.com>,
linux-kernel@...r.kernel.org, linux-pm@...r.kernel.org,
stable@...r.kernel.org
Subject: Re: [PATCH 1/3] cpufreq: fix broken buffer overflow detection in trans_stats
On Tue, Oct 24, 2023 at 8:30 PM Christian Marangi <ansuelsmth@...il.com> wrote:
>
> Commit 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential
> buffer overflow") switched from snprintf to the more secure scnprintf
> but never updated the exit condition for PAGE_SIZE.
>
> As the commit say and as scnprintf document, what scnprintf returns what
> is actually written not counting the '\0' end char. This results in the
> case of len exceeding the size, len set to PAGE_SIZE - 1, as it can be
> written at max PAGESIZE - 1 (as '\0' is not counted)
>
> Because of len is never set to PAGE_SIZE, the function never break early,
> never print the warning and never return -EFBIG.
>
> Fix this by fixing the condition to PAGE_SIZE -1 to correctly trigger
> the error condition.
>
> Cc: stable@...r.kernel.org
> Fixes: 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential buffer overflow")
> Signed-off-by: Christian Marangi <ansuelsmth@...il.com>
> ---
> drivers/cpufreq/cpufreq_stats.c | 14 +++++++-------
> 1 file changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
> index a33df3c66c88..40a9ff18da06 100644
> --- a/drivers/cpufreq/cpufreq_stats.c
> +++ b/drivers/cpufreq/cpufreq_stats.c
> @@ -131,23 +131,23 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf)
> len += sysfs_emit_at(buf, len, " From : To\n");
> len += sysfs_emit_at(buf, len, " : ");
> for (i = 0; i < stats->state_num; i++) {
> - if (len >= PAGE_SIZE)
> + if (len >= PAGE_SIZE - 1)
> break;
> len += sysfs_emit_at(buf, len, "%9u ", stats->freq_table[i]);
> }
> - if (len >= PAGE_SIZE)
> - return PAGE_SIZE;
> + if (len >= PAGE_SIZE - 1)
> + return PAGE_SIZE - 1;
>
> len += sysfs_emit_at(buf, len, "\n");
>
> for (i = 0; i < stats->state_num; i++) {
> - if (len >= PAGE_SIZE)
> + if (len >= PAGE_SIZE - 1)
> break;
>
> len += sysfs_emit_at(buf, len, "%9u: ", stats->freq_table[i]);
>
> for (j = 0; j < stats->state_num; j++) {
> - if (len >= PAGE_SIZE)
> + if (len >= PAGE_SIZE - 1)
> break;
>
> if (pending)
> @@ -157,12 +157,12 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf)
>
> len += sysfs_emit_at(buf, len, "%9u ", count);
> }
> - if (len >= PAGE_SIZE)
> + if (len >= PAGE_SIZE - 1)
> break;
> len += sysfs_emit_at(buf, len, "\n");
> }
>
> - if (len >= PAGE_SIZE) {
> + if (len >= PAGE_SIZE - 1) {
> pr_warn_once("cpufreq transition table exceeds PAGE_SIZE. Disabling\n");
> return -EFBIG;
> }
> --
Applied (with some edits in the subject and changelog) as 6.7 material, thanks!
Powered by blists - more mailing lists