Skip to contentSkip to conversation

early: Fix possible overlapping data buffer

PATCH In review [email protected] 2 participants 2 messages Mar 10, 2011 – Mar 11, 2011 s390

lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 early: Fix possible overlapping data buffer

This patch fixes bugzilla #12965:
https://bugzilla.kernel.org/show_bug.cgi?id=12965

The original code contains dangerous uses of sprintf functions like sprintf(defsys_cmd, "%s EW MINSIZE=%.7iK PARMREGS=0-13", defsys_cmd, min_size), where defsys_cmd is used both as input string as well as output string. It should remember the written bytes of the previous sprintf and use that as the offset when adding something. Also use snprintf makes the code safer.

Signed-off-by Chen Liu<[email protected]>
---
 arch/s390/kernel/early.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
arch/s390/kernel/early.c +5 -4
@@ -94,6 +94,7 @@ static noinline __init void create_kerne
 	unsigned int sinitrd_pfn, einitrd_pfn;
 #endif
 	int response;
+	int hlen;
 	size_t len;
 	char *savesys_ptr;
 	char defsys_cmd[DEFSYS_CMD_SIZE];

@@ -124,7 +125,7 @@ static noinline __init void create_kerne
 	end_pfn = PFN_UP(__pa(&_end));
 	min_size = end_pfn << 2;
 
-	sprintf(defsys_cmd, "DEFSYS %s 00000-%.5X EW %.5X-%.5X SR %.5X-%.5X",
+	hlen = sprintf(defsys_cmd, "DEFSYS %s 00000-%.5X EW %.5X-%.5X SR %.5X-%.5X",
 		kernel_nss_name, stext_pfn - 1, stext_pfn, eshared_pfn - 1,
 		eshared_pfn, end_pfn);
 

@@ -133,13 +134,13 @@ static noinline __init void create_kerne
 		sinitrd_pfn = PFN_DOWN(__pa(INITRD_START));
 		einitrd_pfn = PFN_UP(__pa(INITRD_START + INITRD_SIZE));
 		min_size = einitrd_pfn << 2;
-		sprintf(defsys_cmd, "%s EW %.5X-%.5X", defsys_cmd,
+		hlen += snprintf(defsys_cmd + hlen, DEFSYS_CMD_SIZE - hlen, " EW %.5X-%.5X",
 		sinitrd_pfn, einitrd_pfn);
 	}
 #endif
 
-	sprintf(defsys_cmd, "%s EW MINSIZE=%.7iK PARMREGS=0-13",
-		defsys_cmd, min_size);
+	hlen += snprintf(defsys_cmd + hlen, DEFSYS_CMD_SIZE - hlen, " EW MINSIZE=%.7iK PARMREGS=0-13",
+		min_size);
 	sprintf(savesys_cmd, "SAVESYS %s \n IPL %s",
 		kernel_nss_name, kernel_nss_name);
#1 lore raw
Quoted 2 lines · On Thu, Mar 10, 2011 at 12:33:37PM -0500, [email protected] wrote:

This patch fixes bugzilla #12965:
https://bugzilla.kernel.org/show_bug.cgi?id=12965

Not sure it's worth all the hazzle. After all it's just a theoratical bug, but...

Quoted 7 lines

The original code contains dangerous uses of sprintf functions like sprintf(defsys_cmd, "%s EW MINSIZE=%.7iK PARMREGS=0-13", defsys_cmd, min_size), where defsys_cmd is used both as input string as well as output string. It should remember the written bytes of the previous sprintf and use that as the offset when adding something. Also use snprintf makes the code safer.

Signed-off-by Chen Liu<[email protected]>

Please make sure your From: and Sign-off email addresses match. Also it would be nice if you could add some line breaks in your patch description ;)

Also it would be good to know if you tested the patch. Does saving an NSS still work with your patch applied?

Quoted 16 lines
---
 arch/s390/kernel/early.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
arch/s390/kernel/early.c +1 -0
@@ -94,6 +94,7 @@ static noinline __init void create_kerne
 	unsigned int sinitrd_pfn, einitrd_pfn;
 #endif
 	int response;
+	int hlen;
 	size_t len;
 	char *savesys_ptr;
 	char defsys_cmd[DEFSYS_CMD_SIZE];

arch/s390/kernel/early.c static noinline __init void create_kerne · line 130

Quoted 7 lines
arch/s390/kernel/early.c +1 -1
@@ -124,7 +125,7 @@ static noinline __init void create_kerne
 	end_pfn = PFN_UP(__pa(&_end));
 	min_size = end_pfn << 2;
 
-	sprintf(defsys_cmd, "DEFSYS %s 00000-%.5X EW %.5X-%.5X SR %.5X-%.5X",
+	hlen = sprintf(defsys_cmd, "DEFSYS %s 00000-%.5X EW %.5X-%.5X SR %.5X-%.5X",
 		kernel_nss_name, stext_pfn - 1, stext_pfn, eshared_pfn - 1,
 		eshared_pfn, end_pfn);

Your patch introduced a new line with more than 80 characters long. You also broke indentation since we have a multiline function call with parameters here. In addition you add snprintf calls later. Why not here?
The checkpatch tool might give you some hints.

arch/s390/kernel/early.c static noinline __init void create_kerne · line 138

Quoted 7 lines
arch/s390/kernel/early.c +1 -1
@@ -133,13 +134,13 @@ static noinline __init void create_kerne
 		sinitrd_pfn = PFN_DOWN(__pa(INITRD_START));
 		einitrd_pfn = PFN_UP(__pa(INITRD_START + INITRD_SIZE));
 		min_size = einitrd_pfn << 2;
-		sprintf(defsys_cmd, "%s EW %.5X-%.5X", defsys_cmd,
+		hlen += snprintf(defsys_cmd + hlen, DEFSYS_CMD_SIZE - hlen, " EW %.5X-%.5X",
 		sinitrd_pfn, einitrd_pfn);

Line too long. Plus indentation broken (well, it was already broken). If you add an snprintf() call, then you should also make sure that the resulting string is '\0' terminated.

arch/s390/kernel/early.c static noinline __init void create_kerne · line 143

Quoted 7 lines
arch/s390/kernel/early.c +2 -2
 	}
 #endif
 
-	sprintf(defsys_cmd, "%s EW MINSIZE=%.7iK PARMREGS=0-13",
-		defsys_cmd, min_size);
+	hlen += snprintf(defsys_cmd + hlen, DEFSYS_CMD_SIZE - hlen, " EW MINSIZE=%.7iK PARMREGS=0-13",
+		min_size);

Line too long and indentation broken. Also again you need to make sure that the string is '\0' terminated.
In addition hlen is unused afterwards. So no need to update it here.