All of lore.kernel.org
 help / color / mirror / Atom feed
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
To: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Andrew Morton <akpm@linux-foundation.org>,
	Jiri Kosina <jkosina@suse.cz>,
	Randy Dunlap <rdunlap@infradead.org>,
	Fabian Frederick <fabf@skynet.be>,
	Bjorn Helgaas <bhelgaas@google.com>,
	Ryan Mallon <rmallon@gmail.com>,
	Masanari Iida <standby24x7@gmail.com>,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/2] lib/vsprintf.c: Fix potential NULL deref in hex_string
Date: Wed, 28 Jan 2015 18:43:11 +0200	[thread overview]
Message-ID: <1422463391.31903.303.camel@linux.intel.com> (raw)
In-Reply-To: <87y4omzz0u.fsf@rasmusvillemoes.dk>

On Wed, 2015-01-28 at 16:49 +0100, Rasmus Villemoes wrote:
> On Wed, Jan 28 2015, Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote:
> 
> > On Wed, 2015-01-28 at 14:25 +0100, Rasmus Villemoes wrote:
> >> The helper hex_string() is broken in two ways. First, it doesn't
> >> increment buf regardless of whether there is room to print, so callers
> >> such as kasprintf() that try to probe the correct storage to allocate
> >> will get a too small return value. But even worse, kasprintf() (and
> >> likely anyone else trying to find the size of the result) pass NULL
> >> for buf and 0 for size, so we also have end == NULL. But this means
> >> that the end-1 in hex_string() is (char*)-1, so buf < end-1 is true
> >> and we get a NULL pointer deref. I double-checked this with a trivial
> >> kernel module that just did a kasprintf(GFP_KERNEL, "%14ph",
> >> "CrashBoomBang").
> >
> > Good catch, though I don't like the implementation of fix.
> >
> > What about the following?
> >
> >
> > diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> > index 8690798..47b36ddd 100644
> > --- a/lib/vsprintf.c
> > +++ b/lib/vsprintf.c
> > @@ -783,11 +783,20 @@ char *hex_string(char *buf, char *end, u8 *addr,
> > struct printf_spec spec,
> >         if (spec.field_width > 0)
> >                 len = min_t(int, spec.field_width, 64);
> >  
> > -       for (i = 0; i < len && buf < end - 1; i++) {
> > -               buf = hex_byte_pack(buf, addr[i]);
> > +       for (i = 0; i < len; i++) {
> > +               if (buf < end)
> > +                       *buf = hex_asc_hi(addr[i]);
> > +               ++buf;
> > +
> > +               if (buf < end)
> > +                       *buf = hex_asc_lo(addr[i]);
> > +               ++buf;
> >  
> > -               if (buf < end && separator && i != len - 1)
> > -                       *buf++ = separator;
> > +               if (separator && i != len - 1) {
> > +                       if (buf < end)
> > +                               *buf = separator;
> > +                       ++buf;
> > +               }
> >         }
> >  
> >         return buf;
> 
> I had exactly that at one point. I think the only reason I ended up
> doing it the other way was that I wanted to introduce the write_bytes
> helper, and then use that to do some simplifications and optimizations
> for other %p helpers. Many of those write their output to a temporary
> buffer, knowing exactly how much there is, then delegate to string(),
> which then recomputes the string length before printing. But all that
> can be done another time, so I'm fine with this also.
> 

I ACK the version w/o write_bytes() helper. Meanwhile you may submit
your helper with usage of it as another patch.


-- 
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Intel Finland Oy


  reply	other threads:[~2015-01-29  3:57 UTC|newest]

Thread overview: 52+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-01-28 13:25 [PATCH 0/2] Two printf fixes Rasmus Villemoes
2015-01-28 13:25 ` [PATCH 1/2] lib/vsprintf.c: Fix potential NULL deref in hex_string Rasmus Villemoes
2015-01-28 14:53   ` Andy Shevchenko
2015-01-28 15:49     ` Rasmus Villemoes
2015-01-28 16:43       ` Andy Shevchenko [this message]
2015-01-28 13:25 ` [PATCH 2/2] string_helpers: Change semantics of string_escape_mem Rasmus Villemoes
2015-01-28 15:05   ` Andy Shevchenko
2015-01-29 10:03 ` [PATCH v2 0/3] Two printf fixes Rasmus Villemoes
2015-01-29 10:03   ` [PATCH v2 1/3] lib/vsprintf.c: Fix potential NULL deref in hex_string Rasmus Villemoes
2015-01-29 10:43     ` Andy Shevchenko
2015-01-29 10:03   ` [PATCH v2 2/3] lib/string_helpers.c: Refactor string_escape_mem Rasmus Villemoes
2015-01-29 12:12     ` Andy Shevchenko
2015-01-29 13:10       ` Rasmus Villemoes
2015-01-29 13:37         ` Andy Shevchenko
2015-01-29 19:33           ` Jeff Epler
2015-01-30 10:14             ` Andy Shevchenko
2015-01-29 10:03   ` [PATCH v2 3/3] lib/string_helpers.c: Change semantics of string_escape_mem Rasmus Villemoes
2015-01-29 13:29     ` Andy Shevchenko
2015-01-29 14:29       ` Rasmus Villemoes
2015-01-30 10:27         ` Andy Shevchenko
2015-01-30 23:39           ` Rasmus Villemoes
2015-01-30 23:39             ` Rasmus Villemoes
2015-02-02 10:56             ` Andy Shevchenko
2015-02-09 23:44   ` [PATCH v3 0/3] Two printf fixes Rasmus Villemoes
2015-02-09 23:44     ` Rasmus Villemoes
2015-02-09 23:44     ` [PATCH v3 1/3] lib/vsprintf.c: Fix potential NULL deref in hex_string Rasmus Villemoes
2015-02-09 23:44     ` [PATCH v3 2/3] lib/string_helpers.c: Refactor string_escape_mem Rasmus Villemoes
2015-02-10 12:16       ` Andy Shevchenko
2015-02-09 23:44     ` [PATCH v3 3/3] lib/string_helpers.c: Change semantics of string_escape_mem Rasmus Villemoes
2015-02-09 23:44       ` Rasmus Villemoes
2015-02-10 12:32       ` Andy Shevchenko
2015-02-10 12:32         ` Andy Shevchenko
2015-02-10 13:02         ` Rasmus Villemoes
2015-02-10 14:22           ` Andy Shevchenko
2015-02-10 14:22             ` Andy Shevchenko
2015-02-21  1:35             ` Rasmus Villemoes
2015-02-23 12:50               ` Andy Shevchenko
2015-02-23 12:50                 ` Andy Shevchenko
2015-02-23 22:55                 ` Rasmus Villemoes
2015-02-23 22:55                   ` Rasmus Villemoes
2015-03-02 12:37                   ` Andy Shevchenko
2015-03-02 12:37                     ` Andy Shevchenko
2015-03-02 23:03                     ` Rasmus Villemoes
2015-03-03 10:26                       ` Andy Shevchenko
2015-03-03 10:26                         ` Andy Shevchenko
2015-03-03 23:20     ` [PATCH v4 0/3] Two printf fixes Rasmus Villemoes
2015-03-03 23:20       ` [PATCH v4 1/3] lib/vsprintf.c: Fix potential NULL deref in hex_string Rasmus Villemoes
2015-03-03 23:20       ` [PATCH v4 2/3] lib/string_helpers.c: Refactor string_escape_mem Rasmus Villemoes
2015-03-04 10:51         ` Andy Shevchenko
2015-03-03 23:20       ` [PATCH v4 3/3] lib/string_helpers.c: Change semantics of string_escape_mem Rasmus Villemoes
2015-03-04 11:49         ` Andy Shevchenko
2015-03-04 11:49           ` Andy Shevchenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1422463391.31903.303.camel@linux.intel.com \
    --to=andriy.shevchenko@linux.intel.com \
    --cc=akpm@linux-foundation.org \
    --cc=bhelgaas@google.com \
    --cc=fabf@skynet.be \
    --cc=jkosina@suse.cz \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@rasmusvillemoes.dk \
    --cc=rdunlap@infradead.org \
    --cc=rmallon@gmail.com \
    --cc=standby24x7@gmail.com \
    --subject='Re: [PATCH 1/2] lib/vsprintf.c: Fix potential NULL deref in hex_string' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.