linux-kernel - [PATCH v1 1/1] Input: lifebook - bail out when device path can't fit buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250422185702.1949465-1-andriy.shevchenko@linux.intel.com>
Date: Tue, 22 Apr 2025 21:57:02 +0300
From: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
	linux-input@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Dmitry Torokhov <dmitry.torokhov@...il.com>
Subject: [PATCH v1 1/1] Input: lifebook - bail out when device path can't fit buffer

When creating a physical device name in the driver the snprintf() takes
an up to 32 characters argument along with the additional 8 characters
and tries to pack this into 32 bytes array. GCC complains about that
when build with `make W=1`:

drivers/input/mouse/lifebook.c:282:9: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
 282 |         snprintf(priv->phys, sizeof(priv->phys),
     |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 283 |                  "%s/input1", psmouse->ps2dev.serio->phys);
     |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix these by checking for the potential overflow.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
---
 drivers/input/mouse/lifebook.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/input/mouse/lifebook.c b/drivers/input/mouse/lifebook.c
index 7147dacc404f..58df2c0e53cb 100644
--- a/drivers/input/mouse/lifebook.c
+++ b/drivers/input/mouse/lifebook.c
@@ -272,6 +272,7 @@ static int lifebook_create_relative_device(struct psmouse *psmouse)
 	struct input_dev *dev2;
 	struct lifebook_data *priv;
 	int error = -ENOMEM;
+	int n;
 
 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
 	dev2 = input_allocate_device();
@@ -279,8 +280,13 @@ static int lifebook_create_relative_device(struct psmouse *psmouse)
 		goto err_out;
 
 	priv->dev2 = dev2;
-	snprintf(priv->phys, sizeof(priv->phys),
-		 "%s/input1", psmouse->ps2dev.serio->phys);
+
+	n = snprintf(priv->phys, sizeof(priv->phys),
+		     "%s/input1", psmouse->ps2dev.serio->phys);
+	if (n >= sizeof(priv->phys)) {
+		error = -E2BIG;
+		goto err_out;
+	}
 
 	dev2->phys = priv->phys;
 	dev2->name = "LBPS/2 Fujitsu Lifebook Touchpad";
-- 
2.47.2