Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1720309 > unrolled thread

[PATCH] of: do not leak console options

Back to article view | Back to linux.kernel

Contents

  [PATCH] of: do not leak console options Sergey Senozhatsky <sergey.senozhatsky@gmail.com> - 2017-08-25 19:50 +0200
    Re: [PATCH] of: do not leak console options Rob Herring <robh@kernel.org> - 2017-08-26 00:40 +0200
      Re: [PATCH] of: do not leak console options Sergey Senozhatsky <sergey.senozhatsky@gmail.com> - 2017-08-27 09:30 +0200
        Re: [PATCH] of: do not leak console options Sergey Senozhatsky <sergey.senozhatsky@gmail.com> - 2017-08-27 10:10 +0200
        Re: [PATCH] of: do not leak console options Petr Mladek <pmladek@suse.com> - 2017-09-06 14:50 +0200
          Re: [PATCH] of: do not leak console options Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com> - 2017-09-06 15:40 +0200
            Re: [PATCH] of: do not leak console options Rob Herring <robh@kernel.org> - 2017-09-06 17:30 +0200
              Re: [PATCH] of: do not leak console options Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com> - 2017-09-07 12:10 +0200

#1720309 — [PATCH] of: do not leak console options

If add_preferred_console() returns error then we must free a
copy of `of_stdout_options' that we create right before the
console registration.

Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
---
 drivers/of/base.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index 260d33c0f26c..9fcf7011d206 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1779,10 +1779,17 @@ EXPORT_SYMBOL_GPL(of_alias_get_highest_id);
  */
 bool of_console_check(struct device_node *dn, char *name, int index)
 {
+	bool ret;
+	char *options;
+
 	if (!dn || dn != of_stdout || console_set_on_cmdline)
 		return false;
-	return !add_preferred_console(name, index,
-				      kstrdup(of_stdout_options, GFP_KERNEL));
+
+	options = kstrdup(of_stdout_options, GFP_KERNEL);
+	ret = add_preferred_console(name, index, options);
+	if (ret)
+		kfree(options);
+	return !ret;
 }
 EXPORT_SYMBOL_GPL(of_console_check);
 
-- 
2.14.1

[toc] | [next] | [standalone]

#1720488

On Sat, Aug 26, 2017 at 02:36:47AM +0900, Sergey Senozhatsky wrote:
> If add_preferred_console() returns error then we must free a
> copy of `of_stdout_options' that we create right before the
> console registration.
> 
> Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> ---
>  drivers/of/base.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/of/base.c b/drivers/of/base.c
> index 260d33c0f26c..9fcf7011d206 100644
> --- a/drivers/of/base.c
> +++ b/drivers/of/base.c
> @@ -1779,10 +1779,17 @@ EXPORT_SYMBOL_GPL(of_alias_get_highest_id);
>   */
>  bool of_console_check(struct device_node *dn, char *name, int index)
>  {
> +	bool ret;
> +	char *options;
> +
>  	if (!dn || dn != of_stdout || console_set_on_cmdline)
>  		return false;
> -	return !add_preferred_console(name, index,
> -				      kstrdup(of_stdout_options, GFP_KERNEL));
> +
> +	options = kstrdup(of_stdout_options, GFP_KERNEL);

The real question is why are we doing the kstrdup in the first place. 
AFAICT, the only reason is options within the console/printk code is a 
char * and not a const char *. I can't imagine that options need 
modifications?

Rob

[toc] | [prev] | [next] | [standalone]

#1720773

Hello,

(Cc Andrew, Grant)

On (08/25/17 17:37), Rob Herring wrote:
> On Sat, Aug 26, 2017 at 02:36:47AM +0900, Sergey Senozhatsky wrote:
> > If add_preferred_console() returns error then we must free a
> > copy of `of_stdout_options' that we create right before the
> > console registration.
> > 
> > Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> > ---
> >  drivers/of/base.c | 11 +++++++++--
> >  1 file changed, 9 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/of/base.c b/drivers/of/base.c
> > index 260d33c0f26c..9fcf7011d206 100644
> > --- a/drivers/of/base.c
> > +++ b/drivers/of/base.c
> > @@ -1779,10 +1779,17 @@ EXPORT_SYMBOL_GPL(of_alias_get_highest_id);
> >   */
> >  bool of_console_check(struct device_node *dn, char *name, int index)
> >  {
> > +	bool ret;
> > +	char *options;
> > +
> >  	if (!dn || dn != of_stdout || console_set_on_cmdline)
> >  		return false;
> > -	return !add_preferred_console(name, index,
> > -				      kstrdup(of_stdout_options, GFP_KERNEL));
> > +
> > +	options = kstrdup(of_stdout_options, GFP_KERNEL);
> 
> The real question is why are we doing the kstrdup in the first place. 

I wouldn't know :) let's find that out

the patch used to pass `of_stdout_options' in v1 and v2
https://patches.linaro.org/patch/41559/

starting from v3 options are kstrdup-ed
https://patchwork.kernel.org/patch/5398761/

> AFAICT, the only reason is options within the console/printk code is a 
> char * and not a const char *. I can't imagine that options need 
> modifications?

as far as I can tell, ->match callback has side efects, sometimes.

for example,

register_console()
	newcon->match(newcon, c->name, c->index, c->options)

for amba-pl011.c ends up in pl011_console_match(), which calls

	uart_parse_earlycon(options, &iotype, &addr, &options)

and uart_parse_earlycon() does the following

int uart_parse_earlycon(char *p, unsigned char *iotype, resource_size_t *addr,
			char **options)
{
	if (strncmp(p, "mmio,", 5) == 0) {
		*iotype = UPIO_MEM;
		p += 5;
	} else if (strncmp(p, "mmio16,", 7) == 0) {
		*iotype = UPIO_MEM16;
		p += 7;
	} else if (strncmp(p, "mmio32,", 7) == 0) {
		*iotype = UPIO_MEM32;
		p += 7;
	} else if (strncmp(p, "mmio32be,", 9) == 0) {
		*iotype = UPIO_MEM32BE;
		p += 9;
	} else if (strncmp(p, "mmio32native,", 13) == 0) {
		*iotype = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN) ?
			UPIO_MEM32BE : UPIO_MEM32;
		p += 13;
	} else if (strncmp(p, "io,", 3) == 0) {
		*iotype = UPIO_PORT;
		p += 3;
	} else if (strncmp(p, "0x", 2) == 0) {
		*iotype = UPIO_MEM;
	} else {
		return -EINVAL;
	}

	/*
	 * Before you replace it with kstrtoull(), think about options separator
	 * (',') it will not tolerate
	 */
	*addr = simple_strtoull(p, NULL, 0);
	p = strchr(p, ',');
	if (p)
		p++;

	*options = p;
	return 0;
}

that's just one example I found after a very quick grepping. may be
there are other control paths that can change ->options.
wondering if something like this was the reason for kstrdup().

	-ss

[toc] | [prev] | [next] | [standalone]

#1720791

On (08/27/17 16:19), Sergey Senozhatsky wrote:
[..]
> int uart_parse_earlycon(char *p, unsigned char *iotype, resource_size_t *addr,
> 			char **options)
> {
> 	if (strncmp(p, "mmio,", 5) == 0) {
> 		*iotype = UPIO_MEM;
> 		p += 5;
> 	} else if (strncmp(p, "mmio16,", 7) == 0) {
> 		*iotype = UPIO_MEM16;
> 		p += 7;
> 	} else if (strncmp(p, "mmio32,", 7) == 0) {
> 		*iotype = UPIO_MEM32;
> 		p += 7;
> 	} else if (strncmp(p, "mmio32be,", 9) == 0) {
> 		*iotype = UPIO_MEM32BE;
> 		p += 9;
> 	} else if (strncmp(p, "mmio32native,", 13) == 0) {
> 		*iotype = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN) ?
> 			UPIO_MEM32BE : UPIO_MEM32;
> 		p += 13;
> 	} else if (strncmp(p, "io,", 3) == 0) {
> 		*iotype = UPIO_PORT;
> 		p += 3;
> 	} else if (strncmp(p, "0x", 2) == 0) {
> 		*iotype = UPIO_MEM;
> 	} else {
> 		return -EINVAL;
> 	}
> 
> 	/*
> 	 * Before you replace it with kstrtoull(), think about options separator
> 	 * (',') it will not tolerate
> 	 */
> 	*addr = simple_strtoull(p, NULL, 0);
> 	p = strchr(p, ',');
> 	if (p)
> 		p++;
> 
> 	*options = p;
> 	return 0;
> }
> 
> that's just one example I found after a very quick grepping. may be
> there are other control paths that can change ->options.

well, obviously, it doesn't change the options per se, but it sort of
demonstrates that _probably_ somewhere ->options could be changed. on
the other hand, that ->options = ->options + X makes it rather hard
to kfree() the ->options. well, we never kfree() the ->options anyway,
as far as I can tell...

	-ss

[toc] | [prev] | [next] | [standalone]

#1727405

On Sun 2017-08-27 16:19:10, Sergey Senozhatsky wrote:
> Hello,
> 
> (Cc Andrew, Grant)
> 
> On (08/25/17 17:37), Rob Herring wrote:
> > On Sat, Aug 26, 2017 at 02:36:47AM +0900, Sergey Senozhatsky wrote:
> > > If add_preferred_console() returns error then we must free a
> > > copy of `of_stdout_options' that we create right before the
> > > console registration.
> > > 
> > > Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> > > ---
> > >  drivers/of/base.c | 11 +++++++++--
> > >  1 file changed, 9 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/drivers/of/base.c b/drivers/of/base.c
> > > index 260d33c0f26c..9fcf7011d206 100644
> > > --- a/drivers/of/base.c
> > > +++ b/drivers/of/base.c
> > > @@ -1779,10 +1779,17 @@ EXPORT_SYMBOL_GPL(of_alias_get_highest_id);
> > >   */
> > >  bool of_console_check(struct device_node *dn, char *name, int index)
> > >  {
> > > +	bool ret;
> > > +	char *options;
> > > +
> > >  	if (!dn || dn != of_stdout || console_set_on_cmdline)
> > >  		return false;
> > > -	return !add_preferred_console(name, index,
> > > -				      kstrdup(of_stdout_options, GFP_KERNEL));
> > > +
> > > +	options = kstrdup(of_stdout_options, GFP_KERNEL);
> > 
> > The real question is why are we doing the kstrdup in the first place. 
> 
> I wouldn't know :) let's find that out
> 
> the patch used to pass `of_stdout_options' in v1 and v2
> https://patches.linaro.org/patch/41559/
> 
> starting from v3 options are kstrdup-ed
> https://patchwork.kernel.org/patch/5398761/

I was curious. The const char * was suggested by Grant Likely,
see https://lkml.kernel.org/r/CACxGe6tQ5rWzCUcS+_fFY+rjEyua2khApAoCVKpTuJAghU=N_w@mail.gmail.com
I guess that the reason was to make the of_find_node_by_path()
API clean.

> > AFAICT, the only reason is options within the console/printk code is a 
> > char * and not a const char *. I can't imagine that options need 
> > modifications?
> 
> as far as I can tell, ->match callback has side efects, sometimes.

I hope that the match() callbacks does not have this kind of side
effects. I think that they initialize some stuff, assign some values.
But I hope that they do not modify given strings, like console
name or options. At leats I am unable to find any place.
But I am not 100% sure.

Sigh, the console code really needs clean up.

Best Regards,
Petr

[toc] | [prev] | [next] | [standalone]

#1727479

Hello,

On (09/06/17 14:40), Petr Mladek wrote:
[..]
> > I wouldn't know :) let's find that out
> > 
> > the patch used to pass `of_stdout_options' in v1 and v2
> > https://patches.linaro.org/patch/41559/
> > 
> > starting from v3 options are kstrdup-ed
> > https://patchwork.kernel.org/patch/5398761/
> 
> I was curious. The const char * was suggested by Grant Likely,
> see https://lkml.kernel.org/r/CACxGe6tQ5rWzCUcS+_fFY+rjEyua2khApAoCVKpTuJAghU=N_w@mail.gmail.com
> I guess that the reason was to make the of_find_node_by_path()
> API clean.

ok, thanks.

> > > AFAICT, the only reason is options within the console/printk code is a 
> > > char * and not a const char *. I can't imagine that options need 
> > > modifications?
> > 
> > as far as I can tell, ->match callback has side efects, sometimes.
> 
> I hope that the match() callbacks does not have this kind of side
> effects. I think that they initialize some stuff, assign some values.
> But I hope that they do not modify given strings, like console
> name or options. At leats I am unable to find any place.
> But I am not 100% sure.

yeah, seems like we can pass just char *options.

const-ifying options (and brl options) on the printk side would probably
be a better solution. need to check if we can do that, tho. that also
would require touching printk API, struct console, struct console_cmdline,
->match callbacks of every console in the kernel, etc. not like a big deal,
just potentially a bit of a noisy patch.


Rob, Grant,
will this dirty hack work for you? I can respin the patch.

---
 drivers/of/base.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index 260d33c0f26c..e6839045c454 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1781,8 +1781,8 @@ bool of_console_check(struct device_node *dn, char *name, int index)
 {
 	if (!dn || dn != of_stdout || console_set_on_cmdline)
 		return false;
-	return !add_preferred_console(name, index,
-				      kstrdup(of_stdout_options, GFP_KERNEL));
+
+	return !add_preferred_console(name, index, (char *)of_stdout_options);
 }
 EXPORT_SYMBOL_GPL(of_console_check);
 
-- 
2.14.1

[toc] | [prev] | [next] | [standalone]

#1727602

On Wed, Sep 6, 2017 at 8:29 AM, Sergey Senozhatsky
<sergey.senozhatsky.work@gmail.com> wrote:
> Hello,
>
> On (09/06/17 14:40), Petr Mladek wrote:
> [..]
>> > I wouldn't know :) let's find that out
>> >
>> > the patch used to pass `of_stdout_options' in v1 and v2
>> > https://patches.linaro.org/patch/41559/
>> >
>> > starting from v3 options are kstrdup-ed
>> > https://patchwork.kernel.org/patch/5398761/
>>
>> I was curious. The const char * was suggested by Grant Likely,
>> see https://lkml.kernel.org/r/CACxGe6tQ5rWzCUcS+_fFY+rjEyua2khApAoCVKpTuJAghU=N_w@mail.gmail.com
>> I guess that the reason was to make the of_find_node_by_path()
>> API clean.
>
> ok, thanks.
>
>> > > AFAICT, the only reason is options within the console/printk code is a
>> > > char * and not a const char *. I can't imagine that options need
>> > > modifications?
>> >
>> > as far as I can tell, ->match callback has side efects, sometimes.
>>
>> I hope that the match() callbacks does not have this kind of side
>> effects. I think that they initialize some stuff, assign some values.
>> But I hope that they do not modify given strings, like console
>> name or options. At leats I am unable to find any place.
>> But I am not 100% sure.
>
> yeah, seems like we can pass just char *options.
>
> const-ifying options (and brl options) on the printk side would probably
> be a better solution. need to check if we can do that, tho. that also
> would require touching printk API, struct console, struct console_cmdline,
> ->match callbacks of every console in the kernel, etc. not like a big deal,
> just potentially a bit of a noisy patch.
>
>
> Rob, Grant,
> will this dirty hack work for you? I can respin the patch.

Yes, as long as you intend to fix things later.

Rob

[toc] | [prev] | [next] | [standalone]

#1728110

On (09/06/17 10:27), Rob Herring wrote:
[..]
> 
> Yes, as long as you intend to fix things later.


Hello Rob,

I can try later, but can't guarantee that will succeed :)

	-ss

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web