linux-kernel - Re: [PATCH] drm/xe: replace format-less snprintf() with strscpy()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 28 May 2024 16:46:02 +0200
From: Thomas Hellström <thomas.hellstrom@...ux.intel.com>
To: Arnd Bergmann <arnd@...nel.org>, Lucas De Marchi
 <lucas.demarchi@...el.com>,  Oded Gabbay <ogabbay@...nel.org>
Cc: Arnd Bergmann <arnd@...db.de>, Maarten Lankhorst
 <maarten.lankhorst@...ux.intel.com>, Maxime Ripard <mripard@...nel.org>, 
 Thomas Zimmermann <tzimmermann@...e.de>, David Airlie <airlied@...il.com>,
 Daniel Vetter <daniel@...ll.ch>, Rodrigo Vivi <rodrigo.vivi@...el.com>,
 José Roberto de Souza <jose.souza@...el.com>, Matthew
 Brost <matthew.brost@...el.com>, Francois Dugast
 <francois.dugast@...el.com>, Himal Prasad Ghimiray
 <himal.prasad.ghimiray@...el.com>,  intel-xe@...ts.freedesktop.org,
 dri-devel@...ts.freedesktop.org,  linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/xe: replace format-less snprintf() with strscpy()

On Tue, 2024-05-28 at 15:32 +0200, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@...db.de>
> 
> Using snprintf() with a format string from task->comm is a bit
> dangerous since the string may be controlled by unprivileged
> userspace:
> 
> drivers/gpu/drm/xe/xe_devcoredump.c: In function
> 'devcoredump_snapshot':
> drivers/gpu/drm/xe/xe_devcoredump.c:184:9: error: format not a string
> literal and no format arguments [-Werror=format-security]
>   184 |         snprintf(ss->process_name, sizeof(ss->process_name),
> process_name);
>       |         ^~~~~~~~
> 
> In this case there is no reason for an snprintf(), so use a simpler
> string copy.
> 
> Fixes: b10d0c5e9df7 ("drm/xe: Add process name to devcoredump")
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
Reviewed-by: Thomas Hellström <thomas.hellstrom@...ux.intel.com>

Thanks,

Will pick up and apply as soon as our CI is fit for fight.
/Thomas



> ---
>  drivers/gpu/drm/xe/xe_devcoredump.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c
> b/drivers/gpu/drm/xe/xe_devcoredump.c
> index 1643d44f8bc4..1973bfaece40 100644
> --- a/drivers/gpu/drm/xe/xe_devcoredump.c
> +++ b/drivers/gpu/drm/xe/xe_devcoredump.c
> @@ -181,7 +181,7 @@ static void devcoredump_snapshot(struct
> xe_devcoredump *coredump,
>  		if (task)
>  			process_name = task->comm;
>  	}
> -	snprintf(ss->process_name, sizeof(ss->process_name),
> process_name);
> +	strscpy(ss->process_name, process_name);
>  	if (task)
>  		put_task_struct(task);
>