linux-kernel - Re: [PATCH 1/3] cpufreq: fix broken buffer overflow detection in trans

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <653a4540.050a0220.1e832.01c8@mx.google.com>
Date:   Thu, 26 Oct 2023 12:53:50 +0200
From:   Christian Marangi <ansuelsmth@...il.com>
To:     "Rafael J. Wysocki" <rafael@...nel.org>
Cc:     Viresh Kumar <viresh.kumar@...aro.org>,
        MyungJoo Ham <myungjoo.ham@...sung.com>,
        Kyungmin Park <kyungmin.park@...sung.com>,
        Chanwoo Choi <cw00.choi@...sung.com>,
        Takashi Iwai <tiwai@...e.de>,
        Jonghwa Lee <jonghwa3.lee@...sung.com>,
        linux-kernel@...r.kernel.org, linux-pm@...r.kernel.org,
        stable@...r.kernel.org
Subject: Re: [PATCH 1/3] cpufreq: fix broken buffer overflow detection in
 trans_stats

On Tue, Oct 24, 2023 at 10:03:35PM +0200, Rafael J. Wysocki wrote:
> On Tue, Oct 24, 2023 at 8:30 PM Christian Marangi <ansuelsmth@...il.com> wrote:
> >
> > Commit 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential
> > buffer overflow") switched from snprintf to the more secure scnprintf
> > but never updated the exit condition for PAGE_SIZE.
> >
> > As the commit say and as scnprintf document, what scnprintf returns what
> > is actually written not counting the '\0' end char. This results in the
> > case of len exceeding the size, len set to PAGE_SIZE - 1, as it can be
> > written at max PAGESIZE - 1 (as '\0' is not counted)
> >
> > Because of len is never set to PAGE_SIZE, the function never break early,
> > never print the warning and never return -EFBIG.
> >
> > Fix this by fixing the condition to PAGE_SIZE -1 to correctly trigger
> > the error condition.
> >
> > Cc: stable@...r.kernel.org
> > Fixes: 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential buffer overflow")
> > Signed-off-by: Christian Marangi <ansuelsmth@...il.com>
> > ---
> >  drivers/cpufreq/cpufreq_stats.c | 14 +++++++-------
> >  1 file changed, 7 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
> > index a33df3c66c88..40a9ff18da06 100644
> > --- a/drivers/cpufreq/cpufreq_stats.c
> > +++ b/drivers/cpufreq/cpufreq_stats.c
> > @@ -131,23 +131,23 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf)
> >         len += sysfs_emit_at(buf, len, "   From  :    To\n");
> >         len += sysfs_emit_at(buf, len, "         : ");
> >         for (i = 0; i < stats->state_num; i++) {
> > -               if (len >= PAGE_SIZE)
> > +               if (len >= PAGE_SIZE - 1)
> >                         break;
> >                 len += sysfs_emit_at(buf, len, "%9u ", stats->freq_table[i]);
> >         }
> > -       if (len >= PAGE_SIZE)
> > -               return PAGE_SIZE;
> > +       if (len >= PAGE_SIZE - 1)
> > +               return PAGE_SIZE - 1;
> >
> >         len += sysfs_emit_at(buf, len, "\n");
> >
> >         for (i = 0; i < stats->state_num; i++) {
> > -               if (len >= PAGE_SIZE)
> > +               if (len >= PAGE_SIZE - 1)
> >                         break;
> >
> >                 len += sysfs_emit_at(buf, len, "%9u: ", stats->freq_table[i]);
> >
> >                 for (j = 0; j < stats->state_num; j++) {
> > -                       if (len >= PAGE_SIZE)
> > +                       if (len >= PAGE_SIZE - 1)
> >                                 break;
> >
> >                         if (pending)
> > @@ -157,12 +157,12 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf)
> >
> >                         len += sysfs_emit_at(buf, len, "%9u ", count);
> >                 }
> > -               if (len >= PAGE_SIZE)
> > +               if (len >= PAGE_SIZE - 1)
> >                         break;
> >                 len += sysfs_emit_at(buf, len, "\n");
> >         }
> >
> > -       if (len >= PAGE_SIZE) {
> > +       if (len >= PAGE_SIZE - 1) {
> >                 pr_warn_once("cpufreq transition table exceeds PAGE_SIZE. Disabling\n");
> >                 return -EFBIG;
> >         }
> > --
> 
> Applied (with some edits in the subject and changelog) as 6.7 material, thanks!

Hi, I just notice this landed in linux-next but I can't find the devfreq
change. Only the cpufreq patch has been taken and the devfreq ones are
still pending?

-- 
	Ansuel