linux-kernel - [PATCH v1 1/1] Input: atkbd - bail out when device path can't fit buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250422185657.1949429-1-andriy.shevchenko@linux.intel.com>
Date: Tue, 22 Apr 2025 21:56:57 +0300
From: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To: Dmitry Torokhov <dmitry.torokhov@...il.com>,
	linux-input@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Subject: [PATCH v1 1/1] Input: atkbd - bail out when device path can't fit buffer

When creating a physical device name in the driver the snprintf() takes
an up to 32 characters argument along with the additional 8 characters
and tries to pack this into 32 bytes array. GCC complains about that
when build with `make W=1`:

drivers/input/keyboard/atkbd.c:1194:9: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
 1194 |         snprintf(atkbd->phys, sizeof(atkbd->phys),
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1195 |                  "%s/input0", atkbd->ps2dev.serio->phys);
      |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix these by checking for the potential overflow.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
---
 drivers/input/keyboard/atkbd.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index adf0f311996c..e5d6880ceef6 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -1178,10 +1178,10 @@ static void atkbd_set_keycode_table(struct atkbd *atkbd)
  * atkbd_set_device_attrs() sets up keyboard's input device structure
  */
 
-static void atkbd_set_device_attrs(struct atkbd *atkbd)
+static int atkbd_set_device_attrs(struct atkbd *atkbd)
 {
 	struct input_dev *input_dev = atkbd->dev;
-	int i;
+	int i, n;
 
 	if (atkbd->extra)
 		snprintf(atkbd->name, sizeof(atkbd->name),
@@ -1191,8 +1191,10 @@ static void atkbd_set_device_attrs(struct atkbd *atkbd)
 			 "AT %s Set %d keyboard",
 			 atkbd->translated ? "Translated" : "Raw", atkbd->set);
 
-	snprintf(atkbd->phys, sizeof(atkbd->phys),
-		 "%s/input0", atkbd->ps2dev.serio->phys);
+	n = snprintf(atkbd->phys, sizeof(atkbd->phys),
+		     "%s/input0", atkbd->ps2dev.serio->phys);
+	if (n >= sizeof(atkbd->phys))
+		return -E2BIG;
 
 	input_dev->name = atkbd->name;
 	input_dev->phys = atkbd->phys;
@@ -1245,6 +1247,8 @@ static void atkbd_set_device_attrs(struct atkbd *atkbd)
 			__set_bit(atkbd->keycode[i], input_dev->keybit);
 		}
 	}
+
+	return 0;
 }
 
 static void atkbd_parse_fwnode_data(struct serio *serio)
@@ -1331,7 +1335,10 @@ static int atkbd_connect(struct serio *serio, struct serio_driver *drv)
 	atkbd_parse_fwnode_data(serio);
 
 	atkbd_set_keycode_table(atkbd);
-	atkbd_set_device_attrs(atkbd);
+
+	err = atkbd_set_device_attrs(atkbd);
+	if (err)
+		goto fail3;
 
 	atkbd_enable(atkbd);
 	if (serio->write)
-- 
2.47.2