From patchwork Mon Oct 23 19:33:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christophe JAILLET X-Patchwork-Id: 157074 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:ce89:0:b0:403:3b70:6f57 with SMTP id p9csp1509662vqx; Mon, 23 Oct 2023 12:33:44 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGaBsXFN3MB8iX5VmIlYkVx+7/9C4oYAh3OdS5uERFwwlxXJC9kHJSv07Rp5Dld+ARX766h X-Received: by 2002:a05:6359:6e15:b0:168:e599:cfee with SMTP id th21-20020a0563596e1500b00168e599cfeemr2043855rwb.9.1698089624330; Mon, 23 Oct 2023 12:33:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1698089624; cv=none; d=google.com; s=arc-20160816; b=kY3OThonvICvw48O9galQiQKpLvrt0vtMoOkWxVGfU94GCf15e7Bk22ms132GoSNkD ABnBS5zX/3ACe5w3+9ONKlgEYzw3BNcUHlz/tEdOs7J3erJHlTAQJpyR8TvUyKh8Iv8E u86CXwdZZH5mVencdIByOX8CqnoUcOh+z4S56LdB8e2BIs4vqhSUAzT4u0cdRcGD6rh1 m/bG4bjh5gbMxZ52I81ITPTwiRQqpgUrG6vATdipaKKci6D8V92iCEmPLK0wt/Ei3tHb MjFTjdY5DA7foOVhpJq6WlJURv0vulrEWQ2J92eA1sGHB2i+88NX5IhR4eqLSPfdb2W8 4uBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=MlLlyO5nmPmV+Of5dabISHH05s0yAgNbg1lqfnhBiDo=; fh=BqhVhkt11hdmkbujRH8QIfD2cez9lYpeRoddPZBJma8=; b=0HLtiKPXAsxeKniR29sbHut64o/lXoreLVZddFZG0Z8baEKh2iZ8DXqIfWH7Mctzxc 34XldrARIlhejrI+jCJQ4Z3iAtnGjrOpOYwLH3niWvDid+iHI4S8FJbfln5OYg8WI9+Z ctaxD/FLPj5ycvWP+BGdzmnSJaJRa8PD12vcxe+fp6YEPaUHlKEbM9hIPcCLKqC5jV9O UZXJ/OY4rGv3SbLqnwrzJVzIad08XY16auPWLBq3axXKUkyTUknUOAHaaQUetSOVA0CR ROOliv1s44cEmFGtPzktWiYsX3UzMuNqB1QzrgGCoox44zc/XqKzosudIRxHE8usgLGm LFJw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@wanadoo.fr header.s=t20230301 header.b=migciIyc; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=wanadoo.fr Received: from lipwig.vger.email (lipwig.vger.email. [23.128.96.33]) by mx.google.com with ESMTPS id 20-20020a630114000000b005aa0e024d60si6732593pgb.25.2023.10.23.12.33.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 23 Oct 2023 12:33:44 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33; Authentication-Results: mx.google.com; dkim=pass header.i=@wanadoo.fr header.s=t20230301 header.b=migciIyc; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=wanadoo.fr Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id E9CCA8032A37; Mon, 23 Oct 2023 12:33:40 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230033AbjJWTda (ORCPT + 27 others); Mon, 23 Oct 2023 15:33:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229628AbjJWTd3 (ORCPT ); Mon, 23 Oct 2023 15:33:29 -0400 Received: from smtp.smtpout.orange.fr (smtp-24.smtpout.orange.fr [80.12.242.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8CB11B4 for ; Mon, 23 Oct 2023 12:33:26 -0700 (PDT) Received: from localhost.localdomain ([141.170.221.62]) by smtp.orange.fr with ESMTPSA id v0fzqGEQclciav0fzqWHCB; Mon, 23 Oct 2023 21:33:24 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wanadoo.fr; s=t20230301; t=1698089604; bh=MlLlyO5nmPmV+Of5dabISHH05s0yAgNbg1lqfnhBiDo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=migciIycEHHxVSLdlbD0OWW2VjQcd388g4a4U6rPubKQtgb7HRtjFpJ689ZOdUYfJ M4DjVn6rYm2JxOdyf/1Iv8L43HNqSsvwlKONI+C/7GXglHEqf3PJXDuA3QavdkyrQe p0Ub2Cah2/euUBdqZnOBr/06U7KJDK+7wDHYJSYKqMN/EVMycRrdJPzEBvRfg6sLz0 ToJ4IBNGuk04t0PpFcPhck9S0I+d+73KNfWr+J7PcswUyNqVpMLLYXM5F9DJ9f2cL/ ud6XVZF0TjAnFY3ldTZLfVSVJjXUzRrKUTjGqr+mM6UaMwgZKN2dc0NXOComv7RoB8 kDofSZJzzAWWg== X-ME-Helo: localhost.localdomain X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Mon, 23 Oct 2023 21:33:24 +0200 X-ME-IP: 141.170.221.62 From: Christophe JAILLET To: rafael@kernel.org, lenb@kernel.org Cc: linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET Subject: [PATCH 2/4] ACPI: sysfs: Fix a potential out-of-bound write in create_of_modalias() Date: Mon, 23 Oct 2023 21:33:16 +0200 Message-Id: <004a9aa85dcc37d112443e133c9edfd7624cd47b.1698081019.git.christophe.jaillet@wanadoo.fr> X-Mailer: git-send-email 2.32.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Mon, 23 Oct 2023 12:33:41 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1780576026159462496 X-GMAIL-MSGID: 1780576026159462496 The remaining size of the buffer used by snprintf() is not updated after the first write, so subsequent write in the 'for' loop a few lines below can write some data past the end of the 'modalias' buffer. Correctly update the remaining size. Note that this pattern is already correctly written in create_pnp_modalias(). Fixes: 8765c5ba1949 ("ACPI / scan: Rework modalias creation when "compatible" is present") Signed-off-by: Christophe JAILLET --- drivers/acpi/device_sysfs.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c index 4deb36dccb73..7ec3142f3eda 100644 --- a/drivers/acpi/device_sysfs.c +++ b/drivers/acpi/device_sysfs.c @@ -215,6 +215,8 @@ static int create_of_modalias(const struct acpi_device *acpi_dev, char *modalias if (len >= size) return -ENOMEM; + size -= len; + of_compatible = acpi_dev->data.of_compatible; if (of_compatible->type == ACPI_TYPE_PACKAGE) { nval = of_compatible->package.count;