Message ID | 20230606051323.17698-1-warthog618@gmail.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp3156655vqr; Mon, 5 Jun 2023 22:24:49 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ5+HevS6rwhJ1dXFVlrOFrjaQrm3XLeplhTT2wkp3+IN6zs3yrRDA20CEU3j16jZwGLLe0/ X-Received: by 2002:a5e:880c:0:b0:774:7cdb:1fe4 with SMTP id l12-20020a5e880c000000b007747cdb1fe4mr1927990ioj.13.1686029089490; Mon, 05 Jun 2023 22:24:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686029089; cv=none; d=google.com; s=arc-20160816; b=Sj0Hj3e+en55X8bWf/tAW8sjLcB1kXxyLA8v7VXhYvE7sbuufsXidVQf9ptDMx3xhc TIxob0ji9QGMyU/picoIN8K8Weyu62+aQZyKyxZWbF1fQfydt/W8MBSF8egzoSEO+cA+ PGnQUKroDS/x6hTsRuE+/etVGfxi/umHNYbcBwejpPoTvjh78nHquFCKHXF9xzhETiHC krGC7hjz2V3Xw56KBkCs7POymZOUGGTlFcgchcKb+MRj2WTCvZBDw6KskfADw0cQ8SBI LIGf8enUxacmMGq9x7Box7nVEc++idKQGjlpi6cFwdNMRSyYLBAsZytYqhDsnZvnkU/E o+EA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=WKYJR4KA+z1U9gxuSR1ySk9nbCZtFbh4aaGz3XbVcPg=; b=EsvxLOer+E4YKkaJGXayYK5fsCuUMMTVtJ086woxwqbq93QT1jN4gvC/lREGACGBrY bwOj+im7LXgySJ7lbu8D99Es+VnhsdOQhD1I894otv3hgz6AuOKb9VSnSJ+DkPagAejn RSLAZM08ba8v0ZfHctNUcAuF+bAeiN+h7pfJDxvpCfMewGW1i2xfm6hoW4Zy4MJ0AWQH HjtJmNDDIOmQov+Qf9EFKRe2e0DXQ72DmhY6Nw6uboIYiZ9KiA++fozXsrdrHJZ9iyRY PEqC7TY/HUcMJl0R37+djzwPXhHEgO4XYIkpcWMC30iudZJrhz9FAfew2pMKNb+kjYUH u5lA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=bMqnpM8y; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id i196-20020a639dcd000000b005423d556c22si6741182pgd.466.2023.06.05.22.24.37; Mon, 05 Jun 2023 22:24:49 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=bMqnpM8y; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234328AbjFFFNm (ORCPT <rfc822;xxoosimple@gmail.com> + 99 others); Tue, 6 Jun 2023 01:13:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42560 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233516AbjFFFNk (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Tue, 6 Jun 2023 01:13:40 -0400 Received: from mail-pl1-x634.google.com (mail-pl1-x634.google.com [IPv6:2607:f8b0:4864:20::634]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6FE6D196; Mon, 5 Jun 2023 22:13:39 -0700 (PDT) Received: by mail-pl1-x634.google.com with SMTP id d9443c01a7336-1b02497f4cfso30102595ad.3; Mon, 05 Jun 2023 22:13:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1686028419; x=1688620419; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=WKYJR4KA+z1U9gxuSR1ySk9nbCZtFbh4aaGz3XbVcPg=; b=bMqnpM8yEvMJzPCBcEH/atpe1a2XjmGjUVaW+QPk8Bx6NjExHUkn2r4zZEgjbw/rHg qua8E0QuivjnJdbyDubRJs6I5qnJR4q6RPc/NcOQ32nukki5LRpZLuarZsCBbuSVLc0m PEbg4AcmSGAgVZr6q9nZbLi/4Bqdcg10UDPGwagEZ1ddnhODUTdnzv924jR9ElZkrpj5 RBzPW/WOOS3Gi4QTKGkmbHPQeVtb+ITPtAMiQ/8EK2ujicitK+/gyC9fffjyMPsHXoQu LAyx/O8xBhsgWNJTw+LvK1fjvimy4f/sRHas+3pInOImisiDdWpADwB0dnLu6LwBbTEF crYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686028419; x=1688620419; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=WKYJR4KA+z1U9gxuSR1ySk9nbCZtFbh4aaGz3XbVcPg=; b=HJ2pqnq228mSl9M86ll21J/px2UBW7q9UmTAHhmkxnMDoezD8+4S9LxroQIMfPG8MY ovjN6n78h7/ta4n+c4MoSLpJ8LHB20T/n02iW7MlzzA2Nmd7snUSaYNqH5hqWdLEzouk NTdU1h9zxUQaaA7/qZ60FId8ioR90hYnJZnUojdMyWzKXygrP2RcUoR62fct2Ow2yjK/ w0Vk3UcZOw5w0ctO8q8Z2Of1RU6mUo0CeLRIA3G7VXYcRKF7KSpoNebOMk8z7T1xlren iX463fXv/2w832iSHutogbAAEfn8dRmuLDrFIMfs6dxB9VJ88Yj+ZqnzlktcoWULe8uC 4/GA== X-Gm-Message-State: AC+VfDw2ThOazHXBhCz3Hwlx19Qgyi2QC3GP0V2owMdXXCtjpVr+zeeJ +jGHeeHt5zLM5x2gy347wX0JChYrqe0= X-Received: by 2002:a17:902:d508:b0:1af:cf34:a645 with SMTP id b8-20020a170902d50800b001afcf34a645mr775161plg.21.1686028418705; Mon, 05 Jun 2023 22:13:38 -0700 (PDT) Received: from sol.home.arpa (194-223-178-180.tpgi.com.au. [194.223.178.180]) by smtp.gmail.com with ESMTPSA id i16-20020a170902c95000b001aafb802efbsm7484639pla.12.2023.06.05.22.13.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Jun 2023 22:13:38 -0700 (PDT) From: Kent Gibson <warthog618@gmail.com> To: linux-kernel@vger.kernel.org, linux-gpio@vger.kernel.org, brgl@bgdev.pl, linus.walleij@linaro.org Cc: Kent Gibson <warthog618@gmail.com> Subject: [PATCH] gpio-sim: fix memory corruption when adding named lines and unnamed hogs Date: Tue, 6 Jun 2023 13:13:23 +0800 Message-Id: <20230606051323.17698-1-warthog618@gmail.com> X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_ENVFROM_END_DIGIT, FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767929638662723794?= X-GMAIL-MSGID: =?utf-8?q?1767929638662723794?= |
Series |
gpio-sim: fix memory corruption when adding named lines and unnamed hogs
|
|
Commit Message
Kent Gibson
June 6, 2023, 5:13 a.m. UTC
When constructing the sim, gpio-sim constructs an array of named lines,
sized based on the largest offset of any named line, and then initializes
that array with the names of all lines, including unnamed hogs with higher
offsets. In doing so it writes NULLs beyond the extent of the array.
Add a check that only named lines are used to initialize the array.
Fixes: cb8c474e79be ("gpio: sim: new testing module")
Signed-off-by: Kent Gibson <warthog618@gmail.com>
---
After writing the comment above, and looking at the code again, it may be
clearer to instead check that the offset is within the bounds of the
array. Or do both. Consider that my review.
Cheers,
Kent.
drivers/gpio/gpio-sim.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
Comments
On Tue, Jun 6, 2023 at 7:13 AM Kent Gibson <warthog618@gmail.com> wrote: > > When constructing the sim, gpio-sim constructs an array of named lines, > sized based on the largest offset of any named line, and then initializes > that array with the names of all lines, including unnamed hogs with higher > offsets. In doing so it writes NULLs beyond the extent of the array. > > Add a check that only named lines are used to initialize the array. > > Fixes: cb8c474e79be ("gpio: sim: new testing module") > Signed-off-by: Kent Gibson <warthog618@gmail.com> > --- > > After writing the comment above, and looking at the code again, it may be > clearer to instead check that the offset is within the bounds of the > array. Or do both. Consider that my review. > Like: if (line->offset <= max_offset) line_names[line->offset] = line->name; ? If so, then I agree it makes the purpose of the check clearer. Bart > Cheers, > Kent. > > drivers/gpio/gpio-sim.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpio/gpio-sim.c b/drivers/gpio/gpio-sim.c > index e5dfd636c63c..923e8ff53128 100644 > --- a/drivers/gpio/gpio-sim.c > +++ b/drivers/gpio/gpio-sim.c > @@ -721,8 +721,10 @@ static char **gpio_sim_make_line_names(struct gpio_sim_bank *bank, > if (!line_names) > return ERR_PTR(-ENOMEM); > > - list_for_each_entry(line, &bank->line_list, siblings) > - line_names[line->offset] = line->name; > + list_for_each_entry(line, &bank->line_list, siblings) { > + if (line->name) > + line_names[line->offset] = line->name; > + } > > return line_names; > } > -- > 2.40.1 >
On Tue, Jun 06, 2023 at 12:01:53PM +0200, Bartosz Golaszewski wrote: > On Tue, Jun 6, 2023 at 7:13 AM Kent Gibson <warthog618@gmail.com> wrote: > > > > When constructing the sim, gpio-sim constructs an array of named lines, > > sized based on the largest offset of any named line, and then initializes > > that array with the names of all lines, including unnamed hogs with higher > > offsets. In doing so it writes NULLs beyond the extent of the array. > > > > Add a check that only named lines are used to initialize the array. > > > > Fixes: cb8c474e79be ("gpio: sim: new testing module") > > Signed-off-by: Kent Gibson <warthog618@gmail.com> > > --- > > > > After writing the comment above, and looking at the code again, it may be > > clearer to instead check that the offset is within the bounds of the > > array. Or do both. Consider that my review. > > > > Like: > > if (line->offset <= max_offset) > line_names[line->offset] = line->name; > > ? If so, then I agree it makes the purpose of the check clearer. > Using line_names_size might be even clearer. So, either that or if (line->name && (line->offset <= max_offset)) line_names[line->offset] = line->name; to also not repeat the zeroing that the kcalloc() did. Too many options. Let me know which you prefer. Cheers, Kent.
On Tue, Jun 6, 2023 at 12:19 PM Kent Gibson <warthog618@gmail.com> wrote: > > On Tue, Jun 06, 2023 at 12:01:53PM +0200, Bartosz Golaszewski wrote: > > On Tue, Jun 6, 2023 at 7:13 AM Kent Gibson <warthog618@gmail.com> wrote: > > > > > > When constructing the sim, gpio-sim constructs an array of named lines, > > > sized based on the largest offset of any named line, and then initializes > > > that array with the names of all lines, including unnamed hogs with higher > > > offsets. In doing so it writes NULLs beyond the extent of the array. > > > > > > Add a check that only named lines are used to initialize the array. > > > > > > Fixes: cb8c474e79be ("gpio: sim: new testing module") > > > Signed-off-by: Kent Gibson <warthog618@gmail.com> > > > --- > > > > > > After writing the comment above, and looking at the code again, it may be > > > clearer to instead check that the offset is within the bounds of the > > > array. Or do both. Consider that my review. > > > > > > > Like: > > > > if (line->offset <= max_offset) > > line_names[line->offset] = line->name; > > > > ? If so, then I agree it makes the purpose of the check clearer. > > > > Using line_names_size might be even clearer. > > So, either that or > > if (line->name && (line->offset <= max_offset)) > line_names[line->offset] = line->name; > Yeah, let's go with this one. Bart > to also not repeat the zeroing that the kcalloc() did. > > Too many options. Let me know which you prefer. > > Cheers, > Kent. > > >
diff --git a/drivers/gpio/gpio-sim.c b/drivers/gpio/gpio-sim.c index e5dfd636c63c..923e8ff53128 100644 --- a/drivers/gpio/gpio-sim.c +++ b/drivers/gpio/gpio-sim.c @@ -721,8 +721,10 @@ static char **gpio_sim_make_line_names(struct gpio_sim_bank *bank, if (!line_names) return ERR_PTR(-ENOMEM); - list_for_each_entry(line, &bank->line_list, siblings) - line_names[line->offset] = line->name; + list_for_each_entry(line, &bank->line_list, siblings) { + if (line->name) + line_names[line->offset] = line->name; + } return line_names; }