From patchwork Wed Mar 1 15:22:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miquel Raynal X-Patchwork-Id: 62956 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp3692390wrd; Wed, 1 Mar 2023 07:25:03 -0800 (PST) X-Google-Smtp-Source: AK7set818cXOpug7PB7iVJzPIAiqYc0/VNJzFGJ3HLENGrVBF0SK/d1x8P6ej0mGmHE81GxYNPSW X-Received: by 2002:a17:906:b192:b0:889:ed81:dff7 with SMTP id w18-20020a170906b19200b00889ed81dff7mr7137117ejy.9.1677684303020; Wed, 01 Mar 2023 07:25:03 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677684303; cv=none; d=google.com; s=arc-20160816; b=ue3lXWB3wPGg+c79mmBx4EExLXPFz3xy0iZxanQP6uckN4dFXoyCbDXt5rVIYegr4I 9x8hddJ885tBtSMx+yUEINmYLIPw/O7MpTV+pA3rpqMTkLPBXN8uxd3NwHlmuJ1mFolt OdyQkaKJVA1aQdlnO9MTNrKRL7mEKnleI7eon33k/ILiY/C7iBS3V13qE4wrx3/qhVEF GKDMAPdKjhW9oguINAHsAGtk1loHkNxp4vFnOsZo5jVTYC00xA1nvZuEcfCZXceUhvzm 4L3fbmAjQn4WKWrhZJGjU6gk20sr/tqXJuTsqxFKCN0EA38DopaJ7yOfD/MuHz3bLFFX bLUw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=D5n3KQw5FkYOO2ZCdrhHgke1RNc7JrIvX3lBsallp24=; b=o8ZguT41tU55xTja9eE+Eb5gojUhVwydACr40rEIhOEJ6rhylmgWhXON6nYGiMIY8A YQTUwQ/hEXi+Uar+K1pgooqnNwreqakew5Y0xhXJDgeUoW3H6/U3dZOX8iX9vEw9dS9t dHRHMDvcq4HNlDf4mssTV0s1O6YrSUtXs7T+I7CrTxz72dUl2W3HCApfAZDhnCPW0FkP WWOFtFgMqNjcWeH9ETGsl+EIAeHOv5iX+tRN1MqsZWbDmq+Y14mWv57EfbU4sHfH5bVF lvkAVwudyRCWLOQDuAIIl5NKjoCjr6vnkDVLyRY79yN0uUvoGk9ndtVhp71Vr7wQmq/f 1L6g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@bootlin.com header.s=gm1 header.b=Kj2GBS6P; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=bootlin.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id r3-20020a170906a20300b008e86646e6c5si2669412ejy.780.2023.03.01.07.24.38; Wed, 01 Mar 2023 07:25:03 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@bootlin.com header.s=gm1 header.b=Kj2GBS6P; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=bootlin.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230310AbjCAPWu (ORCPT + 99 others); Wed, 1 Mar 2023 10:22:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43852 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229621AbjCAPWq (ORCPT ); Wed, 1 Mar 2023 10:22:46 -0500 Received: from relay3-d.mail.gandi.net (relay3-d.mail.gandi.net [IPv6:2001:4b98:dc4:8::223]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5C7E043468; Wed, 1 Mar 2023 07:22:44 -0800 (PST) Received: (Authenticated sender: miquel.raynal@bootlin.com) by mail.gandi.net (Postfix) with ESMTPSA id AF9D160012; Wed, 1 Mar 2023 15:22:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1677684162; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=D5n3KQw5FkYOO2ZCdrhHgke1RNc7JrIvX3lBsallp24=; b=Kj2GBS6PPrHijhJPSkrA4vv0KT5OEQjjPzF/nW8BXycugB6Xu2gjOknzG/damIwd2TRanB 1c0enPgMMA8IIszMLk2A2lUxLYou1ZnsNAfPMRSq9UfHRxc2P9tFLXj26oYAbc4GVC4eQN 0KNTTxCFwb+Q76V4T85IG3UhO47piXTUvwK3hJ6FwBGavwT29CLzVbM9dOuJFJb2ToXDjr OTrUQwOkQ2BRS77IXkpqxx9cxjVlAmOP0CcazAKndeBIaTnOp8cdYqdh8H2EI2dOp0YE4J 1zW8buw6ZSfccyYSDnVdkAZpjvXYOopBMxsVq0Sh06xby1+8nOpZXdumZuoSWQ== From: Miquel Raynal To: Srinivas Kandagatla , Cc: Greg Kroah-Hartman , Michael Walle , devicetree@vger.kernel.org, Rob Herring , Frank Rowand , Robert Marko , Luka Perkov , Thomas Petazzoni , rafal@milecki.pl, Miquel Raynal , Stephen Boyd , Peter Chen Subject: [PATCH 1/8] of: Fix modalias string generation Date: Wed, 1 Mar 2023 16:22:32 +0100 Message-Id: <20230301152239.531194-2-miquel.raynal@bootlin.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230301152239.531194-1-miquel.raynal@bootlin.com> References: <20230301152239.531194-1-miquel.raynal@bootlin.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759179495825827970?= X-GMAIL-MSGID: =?utf-8?q?1759179495825827970?= The helper generating an OF based modalias (of_device_get_modalias()) works fine, but due to the use of snprintf() internally it needs a buffer one byte longer than what should be needed just for the entire string (excluding the '\0'). Most users of this helper are sysfs hooks providing the modalias string to users. They all provide a PAGE_SIZE buffer which is way above the number of bytes required to fit the modalias string and hence do not suffer from this issue. There is another user though, of_device_request_module(), which is only called by drivers/usb/common/ulpi.c. This request module function is faulty, but maybe because in most cases there is an alternative, ULPI driver users have not noticed it. In this function, of_device_get_modalias() is called twice. The first time without buffer just to get the number of bytes required by the modalias string (excluding the null byte), and a second time, after buffer allocation, to fill the buffer. The allocation asks for an additional byte, in order to store the trailing '\0'. However, the buffer *length* provided to of_device_get_modalias() excludes this extra byte. The internal use of snprintf() with a length that is exactly the number of bytes to be written has the effect of using the last available byte to store a '\0', which then smashes the last character of the modalias string. Provide the actual size of the buffer to of_device_get_modalias() to fix this issue. Note: the "str[size - 1] = '\0';" line is not really needed as snprintf will anyway end the string with a null byte, but there is a possibility that this function might be called on a struct device_node without compatible, in this case snprintf() would not be executed. So we keep it just to avoid possible unbounded strings. Cc: Stephen Boyd Cc: Peter Chen Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias") Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring --- drivers/of/device.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/of/device.c b/drivers/of/device.c index c674a13c3055..877f50379fab 100644 --- a/drivers/of/device.c +++ b/drivers/of/device.c @@ -297,12 +297,15 @@ int of_device_request_module(struct device *dev) if (size < 0) return size; - str = kmalloc(size + 1, GFP_KERNEL); + /* Reserve an additional byte for the trailing '\0' */ + size++; + + str = kmalloc(size, GFP_KERNEL); if (!str) return -ENOMEM; of_device_get_modalias(dev, str, size); - str[size] = '\0'; + str[size - 1] = '\0'; ret = request_module(str); kfree(str);