linux-kernel - [PATCH v1 1/1] Input: psmouse - bail out when device path can't fit buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250422185707.1949500-1-andriy.shevchenko@linux.intel.com>
Date: Tue, 22 Apr 2025 21:57:07 +0300
From: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To: Dmitry Torokhov <dmitry.torokhov@...il.com>,
	linux-input@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Subject: [PATCH v1 1/1] Input: psmouse - bail out when device path can't fit buffer

When creating a physical device name in the driver the snprintf() takes
an up to 32 characters argument along with the additional 8 characters
and tries to pack this into 32 bytes array. GCC complains about that
when build with `make W=1`:

drivers/input/mouse/psmouse-base.c:1603:9: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
 1603 |         snprintf(psmouse->phys, sizeof(psmouse->phys), "%s/input0", serio->phys);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix these by checking for the potential overflow.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
---
 drivers/input/mouse/psmouse-base.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index a2c9f7144864..bd7d908be7a5 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1578,7 +1578,8 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv)
 {
 	struct psmouse *psmouse, *parent = NULL;
 	struct input_dev *input_dev;
-	int retval = 0, error = -ENOMEM;
+	int error = -ENOMEM;
+	int n;
 
 	mutex_lock(&psmouse_mutex);
 
@@ -1600,7 +1601,12 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv)
 		 psmouse_pre_receive_byte, psmouse_receive_byte);
 	INIT_DELAYED_WORK(&psmouse->resync_work, psmouse_resync);
 	psmouse->dev = input_dev;
-	snprintf(psmouse->phys, sizeof(psmouse->phys), "%s/input0", serio->phys);
+
+	n = snprintf(psmouse->phys, sizeof(psmouse->phys), "%s/input0", serio->phys);
+	if (n >= sizeof(psmouse->phys)) {
+		error = -E2BIG;
+		goto err_free;
+	}
 
 	psmouse_set_state(psmouse, PSMOUSE_INITIALIZING);
 
@@ -1654,7 +1660,7 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv)
 		psmouse_activate(parent);
 
 	mutex_unlock(&psmouse_mutex);
-	return retval;
+	return error;
 
  err_protocol_disconnect:
 	if (psmouse->disconnect)
@@ -1668,7 +1674,6 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv)
 	input_free_device(input_dev);
 	kfree(psmouse);
 
-	retval = error;
 	goto out;
 }
 
-- 
2.47.2