Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1741658 > unrolled thread

[PATCH v2 0/3] params: Fix potential buffer overflows

Back to article view | Back to linux.kernel

Contents

  [PATCH v2 0/3] params: Fix potential buffer overflows Jean Delvare <jdelvare@suse.de> - 2017-09-28 17:50 +0200
    [PATCH v2 2/3] params: Fix an overflow in param_attr_show Jean Delvare <jdelvare@suse.de> - 2017-09-28 17:50 +0200
    [PATCH v2 1/3] params: Fix the maximum length in param_get_string Jean Delvare <jdelvare@suse.de> - 2017-09-28 17:50 +0200
    Re: [PATCH v2 0/3] params: Fix potential buffer overflows Ingo Molnar <mingo@kernel.org> - 2017-09-28 18:00 +0200

#1741658 — [PATCH v2 0/3] params: Fix potential buffer overflows

[PATCH 1/3] params: Fix the maximum length in param_get_string
[PATCH 2/3] params: Fix an overflow in param_attr_show
[PATCH 3/3] params: Improve STANDARD_PARAM_DEF readability

-- 
Jean Delvare
SUSE L3 Support

[toc] | [next] | [standalone]

#1741659 — [PATCH v2 2/3] params: Fix an overflow in param_attr_show

Function param_attr_show could overflow the buffer it is operating
on. The buffer size is PAGE_SIZE, and the string returned by
attribute->param->ops->get is generated by scnprintf(buffer,
PAGE_SIZE, ...) so it could be PAGE_SIZE - 1 long, with the
terminating '\0' at the very end of the buffer. Calling
strcat(..., "\n") on this isn't safe, as the '\0' will be replaced
by '\n' (OK) and then another '\0' will be added past the end of
the buffer (not OK.)

Simply add the trailing '\n' when writing the attribute contents to
the buffer originally. This is safe, and also faster.

Credits to Teradata for discovering this issue.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
---
Changes since v1:
* Add the \n inside the STANDARD_PARAM_DEF macro instead of changing
  all the callers.
* Handle boolean and string types too.
* Handle parameter arrays properly.

 kernel/params.c |   17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

--- linux-4.13.orig/kernel/params.c	2017-09-28 11:09:47.573434740 +0200
+++ linux-4.13/kernel/params.c	2017-09-28 14:40:16.625647445 +0200
@@ -224,7 +224,7 @@ char *parse_args(const char *doing,
 	}								\
 	int param_get_##name(char *buffer, const struct kernel_param *kp) \
 	{								\
-		return scnprintf(buffer, PAGE_SIZE, format,		\
+		return scnprintf(buffer, PAGE_SIZE, format "\n",	\
 				*((type *)kp->arg));			\
 	}								\
 	const struct kernel_param_ops param_ops_##name = {			\
@@ -270,7 +270,7 @@ EXPORT_SYMBOL(param_set_charp);
 
 int param_get_charp(char *buffer, const struct kernel_param *kp)
 {
-	return scnprintf(buffer, PAGE_SIZE, "%s", *((char **)kp->arg));
+	return scnprintf(buffer, PAGE_SIZE, "%s\n", *((char **)kp->arg));
 }
 EXPORT_SYMBOL(param_get_charp);
 
@@ -301,7 +301,7 @@ EXPORT_SYMBOL(param_set_bool);
 int param_get_bool(char *buffer, const struct kernel_param *kp)
 {
 	/* Y and N chosen as being relatively non-coder friendly */
-	return sprintf(buffer, "%c", *(bool *)kp->arg ? 'Y' : 'N');
+	return sprintf(buffer, "%c\n", *(bool *)kp->arg ? 'Y' : 'N');
 }
 EXPORT_SYMBOL(param_get_bool);
 
@@ -360,7 +360,7 @@ EXPORT_SYMBOL(param_set_invbool);
 
 int param_get_invbool(char *buffer, const struct kernel_param *kp)
 {
-	return sprintf(buffer, "%c", (*(bool *)kp->arg) ? 'N' : 'Y');
+	return sprintf(buffer, "%c\n", (*(bool *)kp->arg) ? 'N' : 'Y');
 }
 EXPORT_SYMBOL(param_get_invbool);
 
@@ -460,8 +460,9 @@ static int param_array_get(char *buffer,
 	struct kernel_param p = *kp;
 
 	for (i = off = 0; i < (arr->num ? *arr->num : arr->max); i++) {
+		/* Replace \n with comma */
 		if (i)
-			buffer[off++] = ',';
+			buffer[off - 1] = ',';
 		p.arg = arr->elem + arr->elemsize * i;
 		check_kparam_locked(p.mod);
 		ret = arr->ops->get(buffer + off, &p);
@@ -507,7 +508,7 @@ EXPORT_SYMBOL(param_set_copystring);
 int param_get_string(char *buffer, const struct kernel_param *kp)
 {
 	const struct kparam_string *kps = kp->str;
-	return strlcpy(buffer, kps->string, PAGE_SIZE);
+	return scnprintf(buffer, PAGE_SIZE, "%s\n", kps->string);
 }
 EXPORT_SYMBOL(param_get_string);
 
@@ -549,10 +550,6 @@ static ssize_t param_attr_show(struct mo
 	kernel_param_lock(mk->mod);
 	count = attribute->param->ops->get(buf, attribute->param);
 	kernel_param_unlock(mk->mod);
-	if (count > 0) {
-		strcat(buf, "\n");
-		++count;
-	}
 	return count;
 }
 

-- 
Jean Delvare
SUSE L3 Support

[toc] | [prev] | [next] | [standalone]

#1741661 — [PATCH v2 1/3] params: Fix the maximum length in param_get_string

The length parameter of strlcpy() is supposed to reflect the size of
the target buffer, not of the source string. Harmless in this case as
the buffer is PAGE_SIZE long and the source string is always much
shorter than this, but conceptually wrong, so let's fix it.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
---
Changes since v1:
* Patch added

 kernel/params.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-4.13.orig/kernel/params.c	2017-09-28 11:09:09.604089430 +0200
+++ linux-4.13/kernel/params.c	2017-09-28 11:09:47.573434740 +0200
@@ -507,7 +507,7 @@ EXPORT_SYMBOL(param_set_copystring);
 int param_get_string(char *buffer, const struct kernel_param *kp)
 {
 	const struct kparam_string *kps = kp->str;
-	return strlcpy(buffer, kps->string, kps->maxlen);
+	return strlcpy(buffer, kps->string, PAGE_SIZE);
 }
 EXPORT_SYMBOL(param_get_string);
 

-- 
Jean Delvare
SUSE L3 Support

[toc] | [prev] | [next] | [standalone]

#1741665

* Jean Delvare <jdelvare@suse.de> wrote:

> [PATCH 1/3] params: Fix the maximum length in param_get_string
> [PATCH 2/3] params: Fix an overflow in param_attr_show
> [PATCH 3/3] params: Improve STANDARD_PARAM_DEF readability

It all looks sensible to me, so FWIIW:

  Acked-by: Ingo Molnar <mingo@kernel.org>

(but I have not tested it.)

Thanks,

	Ingo

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web