Skip to contentSkip to conversation

serial: samsung: fix buffer size for clk_name

PATCH Superseded Alexey V. Vissarionov 3 participants 7 messages Jan 16, 2023 – Feb 1, 2023

Subsystems (2)
Arm Samsung Exynos TTY layer and serial drivers
lore
Share & tools
lore

Alexey V. Vissarionov

author
#0 lore raw

PATCH 1/1 serial: samsung: fix buffer size for clk_name

Although very unlikely, the 'clk_num' value may be as big as 2**32 - 1 (uint32_max), so the buffer should have enough space for storing "clk_uart_baud4294967295\0". Also, the numbers in clk_name are expected to be unsigned.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes 5f5a7a5578c58852 ("serial: samsung: switch to clkdev based clock lookup")
Signed-off-by Alexey V. Vissarionov <[email protected]>
drivers/tty/serial/samsung_tty.c +4 -4
index 0fce856434dafd80..2c701dc7c6a37191 100644
@@ -1407,7 +1407,7 @@ static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level,
  *
  */
 
-#define MAX_CLK_NAME_LENGTH 15
+#define MAX_CLK_NAME_LENGTH 24		/* "clk_uart_baud4294967295\0" */
 
 static inline int s3c24xx_serial_getsource(struct uart_port *port)
 {

@@ -1457,7 +1457,7 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport,
 			!(ourport->cfg->clk_sel & (1 << cnt)))
 			continue;
 
-		sprintf(clkname, "clk_uart_baud%d", cnt);
+		sprintf(clkname, "clk_uart_baud%u", cnt);
 		clk = clk_get(ourport->port.dev, clkname);
 		if (IS_ERR(clk))
 			continue;

@@ -1957,7 +1957,7 @@ static int s3c24xx_serial_enable_baudclk(struct s3c24xx_uart_port *ourport)
 		if (!(clk_sel & (1 << clk_num)))
 			continue;
 
-		sprintf(clk_name, "clk_uart_baud%d", clk_num);
+		sprintf(clk_name, "clk_uart_baud%u", clk_num);
 		clk = clk_get(dev, clk_name);
 		if (IS_ERR(clk))
 			continue;

@@ -2522,7 +2522,7 @@ s3c24xx_serial_get_options(struct uart_port *port, int *baud,
 		/* now calculate the baud rate */
 
 		clk_sel = s3c24xx_serial_getsource(port);
-		sprintf(clk_name, "clk_uart_baud%d", clk_sel);
+		sprintf(clk_name, "clk_uart_baud%u", clk_sel);
 
 		clk = clk_get(port->dev, clk_name);
 		if (!IS_ERR(clk))
Signature · 3 lines
Alexey V. Vissarionov
gremlin ПРИ altlinux ТЧК org; +vii-cmiii-ccxxix-lxxix-xlii
GPG: 0D92F19E1C0DC36E27F61A29CD17E2B43D879005 @ hkp://keys.gnupg.net

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

#1 lore raw
Quoted 2 lines · Alexey V. Vissarionov

Although very unlikely, the 'clk_num' value may be as big as 2**32 - 1 (uint32_max),

How it could be that high? Code has num_clks defined from 1 to 4 and it is used as strict boundary for the loop so how it could end up here with higher value?

s3c24xx_serial_getsource() also returns value & with mask, so up to 4 max. This does not look like real issue but some change to satisfy static code analyzers, so I don't think it's correct approach.

Best regards,
Krzysztof

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

author
#2 lore raw
Quoted 5 lines · Krzysztof Kozlowski
Quoted 2 lines

Although very unlikely, the 'clk_num' value may be as big as 2**32 - 1 (uint32_max),

How it could be that high? Code has num_clks defined from 1 to 4 and it is used as strict boundary for the loop so how it could end up here with higher value?

That's why I called this "very unlikely". However, nobody can definitely exclude the possibility of extending this limit in the future.

Quoted 2 lines

s3c24xx_serial_getsource() also returns value & with mask, so up to 4 max.

Possibly, clk_num should be uint8_t then - so the buffer size could be extended up to only 17 bytes ("clk_uart_baud255\0") with format specifiers changed to "%u", or 18 bytes for "%d" (clk_uart_baud-128\0).

Quoted 2 lines

This does not look like real issue but some change to satisfy static code analyzers, so I don't think it's correct approach.

Although I agree this is probably only a theoretical issue, it's always easier to spend several bytes than to prove that we don't need to.

But, anyway, the final decision is up to you.

Signature · 3 lines
Alexey V. Vissarionov
gremlin ПРИ altlinux ТЧК org; +vii-cmiii-ccxxix-lxxix-xlii
GPG: 0D92F19E1C0DC36E27F61A29CD17E2B43D879005 @ hkp://keys.gnupg.net

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

maintainer
#3 lore raw
In reply to Alexey V. Vissarionov
Quoted 8 lines · Alexey V. Vissarionov

Although very unlikely, the 'clk_num' value may be as big as 2**32 - 1 (uint32_max), so the buffer should have enough space for storing "clk_uart_baud4294967295\0". Also, the numbers in clk_name are expected to be unsigned.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes 5f5a7a5578c58852 ("serial: samsung: switch to clkdev based clock lookup")

Please fix your scripts to use the proper number of SHA1 digits in a
Fixes: line as the documentation asks for.

thanks,

greg k-h

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

author
#4 lore raw

PATCH v2 1/1 serial: samsung: fix buffer size for clk_name

serial: samsung: fix buffer size for clk_name

Although very unlikely, the 'clk_num' value may be as big as 2**32 - 1 (uint32_max), so the buffer should have enough space for storing "clk_uart_baud4294967295\0". Also, the numbers in clk_name are expected to be unsigned.

Found by ALT Linux Team (altlinux.org) and Linux Verification Center (linuxtesting.org) using SVACE.

Signed-off-by Alexey V. Vissarionov <[email protected]>
Fixes 5f5a7a5578c5 ("serial: samsung: switch to clkdev based clock lookup")

---

Quoted 4 lines · Greg Kroah-Hartman
Quoted 2 lines
Fixes 5f5a7a5578c58852 ("serial: samsung: switch to clkdev

based clock lookup")

Please fix your scripts to use the proper number of SHA1 digits in a Fixes: line as the documentation asks for.

Done. Also added the comment to the source regarding the buffer size.

drivers/tty/serial/samsung_tty.c +4 -4
index 0fce856434dafd80..2c701dc7c6a37191 100644
@@ -1407,7 +1407,7 @@ static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level,
  *
  */
 
-#define MAX_CLK_NAME_LENGTH 15
+#define MAX_CLK_NAME_LENGTH 24		/* "clk_uart_baud4294967295\0" */
 
 static inline int s3c24xx_serial_getsource(struct uart_port *port)
 {

@@ -1457,7 +1457,7 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport,
 			!(ourport->cfg->clk_sel & (1 << cnt)))
 			continue;
 
-		sprintf(clkname, "clk_uart_baud%d", cnt);
+		sprintf(clkname, "clk_uart_baud%u", cnt);
 		clk = clk_get(ourport->port.dev, clkname);
 		if (IS_ERR(clk))
 			continue;

@@ -1957,7 +1957,7 @@ static int s3c24xx_serial_enable_baudclk(struct s3c24xx_uart_port *ourport)
 		if (!(clk_sel & (1 << clk_num)))
 			continue;
 
-		sprintf(clk_name, "clk_uart_baud%d", clk_num);
+		sprintf(clk_name, "clk_uart_baud%u", clk_num);
 		clk = clk_get(dev, clk_name);
 		if (IS_ERR(clk))
 			continue;

@@ -2522,7 +2522,7 @@ s3c24xx_serial_get_options(struct uart_port *port, int *baud,
 		/* now calculate the baud rate */
 
 		clk_sel = s3c24xx_serial_getsource(port);
-		sprintf(clk_name, "clk_uart_baud%d", clk_sel);
+		sprintf(clk_name, "clk_uart_baud%u", clk_sel);
 
 		clk = clk_get(port->dev, clk_name);
 		if (!IS_ERR(clk))
Signature · 3 lines
Alexey V. Vissarionov
gremlin ПРИ altlinux ТЧК org; +vii-cmiii-ccxxix-lxxix-xlii
GPG: 0D92F19E1C0DC36E27F61A29CD17E2B43D879005 @ hkp://keys.gnupg.net
#5 lore raw
Quoted 1 line · Alexey V. Vissarionov

serial: samsung: fix buffer size for clk_name

This does not belong here.

Quoted 11 lines

Although very unlikely, the 'clk_num' value may be as big as 2**32 - 1 (uint32_max), so the buffer should have enough space for storing "clk_uart_baud4294967295\0". Also, the numbers in clk_name are expected to be unsigned.

Found by ALT Linux Team (altlinux.org) and Linux Verification Center (linuxtesting.org) using SVACE.

Signed-off-by Alexey V. Vissarionov <[email protected]>
Fixes 5f5a7a5578c5 ("serial: samsung: switch to clkdev based clock lookup")

How did you address my comments? the clk_num cannot be beig as 2^32-1. It's not possible, if I understand correctly.

Quoted 18 lines

---

Quoted 4 lines · Greg Kroah-Hartman
Quoted 2 lines
Fixes 5f5a7a5578c58852 ("serial: samsung: switch to clkdev

based clock lookup")

Please fix your scripts to use the proper number of SHA1 digits in a Fixes: line as the documentation asks for.

Done. Also added the comment to the source regarding the buffer size.

drivers/tty/serial/samsung_tty.c +0 -0
index 0fce856434dafd80..2c701dc7c6a37191 100644

drivers/tty/serial/samsung_tty.c static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level, · line 1410

Quoted 5 lines
drivers/tty/serial/samsung_tty.c +1 -1
@@ -1407,7 +1407,7 @@ static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level,
  *
  */
 
-#define MAX_CLK_NAME_LENGTH 15
+#define MAX_CLK_NAME_LENGTH 24		/* "clk_uart_baud4294967295\0" */

NAK. It's just waste of space.

Best regards,
Krzysztof

maintainer
#6 lore raw
In reply to Alexey V. Vissarionov
Quoted 39 lines · Alexey V. Vissarionov

serial: samsung: fix buffer size for clk_name

Although very unlikely, the 'clk_num' value may be as big as 2**32 - 1 (uint32_max), so the buffer should have enough space for storing "clk_uart_baud4294967295\0". Also, the numbers in clk_name are expected to be unsigned.

Found by ALT Linux Team (altlinux.org) and Linux Verification Center (linuxtesting.org) using SVACE.

Signed-off-by Alexey V. Vissarionov <[email protected]>
Fixes 5f5a7a5578c5 ("serial: samsung: switch to clkdev based clock lookup")

---

Quoted 4 lines · Greg Kroah-Hartman
Quoted 2 lines
Fixes 5f5a7a5578c58852 ("serial: samsung: switch to clkdev

based clock lookup")

Please fix your scripts to use the proper number of SHA1 digits in a Fixes: line as the documentation asks for.

Done. Also added the comment to the source regarding the buffer size.

drivers/tty/serial/samsung_tty.c +1 -1
index 0fce856434dafd80..2c701dc7c6a37191 100644
@@ -1407,7 +1407,7 @@ static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level,
  *
  */
 
-#define MAX_CLK_NAME_LENGTH 15
+#define MAX_CLK_NAME_LENGTH 24		/* "clk_uart_baud4294967295\0" */
 
 static inline int s3c24xx_serial_getsource(struct uart_port *port)
 {

drivers/tty/serial/samsung_tty.c static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport, · line 1460

Quoted 5 lines
drivers/tty/serial/samsung_tty.c +1 -1
@@ -1457,7 +1457,7 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport,
 			!(ourport->cfg->clk_sel & (1 << cnt)))
 			continue;
 
-		sprintf(clkname, "clk_uart_baud%d", cnt);
+		sprintf(clkname, "clk_uart_baud%u", cnt);

So you bump the size of the buffer and continue to use an "unsafe" call that could overflow the buffer? Is this a plan to submit a series of patches all "fixing" something based on the last change? :)

As Krzysztof said, this whole thing is not needed at all. Please fix your tool to generate valid changes.

thanks,

greg k-h