Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1301410 > unrolled thread

Re: [PATCH V3 2/2] PM / OPP: Parse 'opp-<prop>-<name>' bindings

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH V3 2/2] PM / OPP: Parse 'opp-<prop>-<name>' bindings Geert Uytterhoeven <geert@linux-m68k.org> - 2016-01-05 11:40 +0100
    Re: [PATCH V3 2/2] PM / OPP: Parse 'opp-<prop>-<name>' bindings Viresh Kumar <viresh.kumar@linaro.org> - 2016-01-05 11:50 +0100

#1301410 — Re: [PATCH V3 2/2] PM / OPP: Parse 'opp-<prop>-<name>' bindings

Hi Viresh,

On Wed, Dec 9, 2015 at 3:31 AM, Viresh Kumar <viresh.kumar@linaro.org> wrote:
> OPP bindings (for few properties) allow a platform to choose a
> value/range among a set of available options. The options are present as
> opp-<prop>-<name>, where the platform needs to supply the <name> string.
>
> The OPP properties which allow such an option are: opp-microvolt and
> opp-microamp.
>
> Add support to the OPP-core to parse these bindings, by introducing
> dev_pm_opp_{set|put}_prop_name() APIs.
>
> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>

> @@ -794,35 +797,48 @@ static int _opp_add_v1(struct device *dev, unsigned long freq, long u_volt,
>  }
>
>  /* TODO: Support multiple regulators */
> -static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev)
> +static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
> +                             struct device_opp *dev_opp)
>  {
>         u32 microvolt[3] = {0};
>         u32 val;
>         int count, ret;
> +       struct property *prop = NULL;
> +       char name[NAME_MAX];
> +
> +       /* Search for "opp-microvolt-<name>" */
> +       if (dev_opp->prop_name) {
> +               sprintf(name, "opp-microvolt-%s", dev_opp->prop_name);

Any chance an attacker can overflow name[] by providing a very long
dev_opp->prop_name?

Better safe than sorry:

        snprintf(name, sizeof(name), ...);

> +               prop = of_find_property(opp->np, name, NULL);
> +       }

> @@ -830,7 +846,20 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev)
>         opp->u_volt_min = microvolt[1];
>         opp->u_volt_max = microvolt[2];
>
> -       if (!of_property_read_u32(opp->np, "opp-microamp", &val))
> +       /* Search for "opp-microamp-<name>" */
> +       prop = NULL;
> +       if (dev_opp->prop_name) {
> +               sprintf(name, "opp-microamp-%s", dev_opp->prop_name);

Likewise

> +               prop = of_find_property(opp->np, name, NULL);
> +       }

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1301417

On 05-01-16, 11:31, Geert Uytterhoeven wrote:
> Any chance an attacker can overflow name[] by providing a very long
> dev_opp->prop_name?
> 
> Better safe than sorry:
> 
>         snprintf(name, sizeof(name), ...);

Sent a patch to you..

-- 
viresh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web