linux-kernel - Re: [PATCH 1/2] mm/huge_memory: skip invalid debugfs file entry for folio split

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 24 Apr 2024 21:03:51 -0400
From: Zi Yan <ziy@...dia.com>
To: Luis Chamberlain <mcgrof@...nel.org>
Cc: akpm@...ux-foundation.org, linux-mm@...ck.org, fstests@...r.kernel.org,
 linux-xfs@...r.kernel.org, linux-kernel@...r.kernel.org, willy@...radead.org,
 hare@...e.de, john.g.garry@...cle.com, p.raghav@...sung.com,
 da.gomez@...sung.com
Subject: Re: [PATCH 1/2] mm/huge_memory: skip invalid debugfs file entry for
 folio split

On 24 Apr 2024, at 18:54, Luis Chamberlain wrote:

> If the file entry is too long we may easily end up going out of bounds
> and crash after strsep() on sscanf(). To avoid this ensure we bound the
> string to an expected length before we use sscanf() on it.
>
> Signed-off-by: Luis Chamberlain <mcgrof@...nel.org>
> ---
>  mm/huge_memory.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 9e9879d2f501..8386d24a163e 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -3623,6 +3623,7 @@ static ssize_t split_huge_pages_write(struct file *file, const char __user *buf,
>  		char file_path[MAX_INPUT_BUF_SZ];
>  		pgoff_t off_start = 0, off_end = 0;
>  		size_t input_len = strlen(input_buf);
> +		size_t max_left_over;
>
>  		tok = strsep(&buf, ",");
>  		if (tok) {
> @@ -3632,6 +3633,14 @@ static ssize_t split_huge_pages_write(struct file *file, const char __user *buf,
>  			goto out;
>  		}
>
> +		max_left_over = MAX_INPUT_BUF_SZ - strlen(file_path);
> +		if (!buf ||
> +		    strnlen(buf, max_left_over) < 7 ||

What is this magic number 7? strlen("0xN,0xN") as the minimal input string size?
Maybe use sizeof("0xN,0xN") - 1 instead?

> +		    strnlen(buf, max_left_over) > max_left_over) {
> +			ret = -EINVAL;
> +			goto out;
> +		}
> +
>  		ret = sscanf(buf, "0x%lx,0x%lx,%d", &off_start, &off_end, &new_order);
>  		if (ret != 2 && ret != 3) {
>  			ret = -EINVAL;
> -- 
> 2.43.0

Everything else looks good to me. Reviewed-by: Zi Yan <ziy@...dia.com>

--
Best Regards,
Yan, Zi

Download attachment "signature.asc" of type "application/pgp-signature" (855 bytes)