From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754216AbbE0TGu (ORCPT ); Wed, 27 May 2015 15:06:50 -0400 Received: from mail.skyhub.de ([78.46.96.112]:33638 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751481AbbE0TGi (ORCPT ); Wed, 27 May 2015 15:06:38 -0400 Date: Wed, 27 May 2015 21:06:26 +0200 From: Borislav Petkov To: Joe Perches Cc: luto@amacapital.net, peterz@infradead.org, dvlasenk@redhat.com, torvalds@linux-foundation.org, imammedo@redhat.com, brgerst@gmail.com, mingo@kernel.org, prarit@redhat.com, dave.hansen@linux.intel.com, fenghua.yu@intel.com, hpa@zytor.com, linux-kernel@vger.kernel.org, tglx@linutronix.de, bp@suse.de, linux-tip-commits@vger.kernel.org Subject: Re: [tip:x86/cpu] x86/cpu: Strip any /proc/ cpuinfo model name field whitespace Message-ID: <20150527190626.GC19407@pd.tnic> References: <1432050210-32036-1-git-send-email-prarit@redhat.com> <1432628901-18044-15-git-send-email-bp@alien8.de> <1432746454.2846.154.camel@perches.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <1432746454.2846.154.camel@perches.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, May 27, 2015 at 10:07:34AM -0700, Joe Perches wrote: > This code can memmove from beyond the x86_model_id field. ... in the theoretical case where some model ID has more than 64 - 48 preceding white spaces. I guess we want to be prepared here for insane CPU model IDs coming from virtualization. > Maybe: > char *model = strim(c->x86_model_id); > memmove(c->x86_model_id, model, strlen(model) + 1); Yes, and additionally limit that string length: --- diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index b35c777df6df..9d1fd48486d6 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -383,6 +383,9 @@ static const struct cpu_dev *cpu_devs[X86_VENDOR_NUM] = {}; static void get_model_name(struct cpuinfo_x86 *c) { unsigned int *v; + const char *model; + +#define MODEL_ID_MAXLEN 48 if (c->extended_cpuid_level < 0x80000004) return; @@ -391,13 +394,15 @@ static void get_model_name(struct cpuinfo_x86 *c) cpuid(0x80000002, &v[0], &v[1], &v[2], &v[3]); cpuid(0x80000003, &v[4], &v[5], &v[6], &v[7]); cpuid(0x80000004, &v[8], &v[9], &v[10], &v[11]); - c->x86_model_id[48] = 0; + c->x86_model_id[MODEL_ID_MAXLEN] = 0; /* * Remove leading whitespace on Intel processors and trailing * whitespace on AMD processors. */ - memmove(c->x86_model_id, strim(c->x86_model_id), 48); + model = strim(c->x86_model_id); + + memmove(c->x86_model_id, model, strnlen(model, MODEL_ID_MAXLEN) + 1); } void cpu_detect_cache_sizes(struct cpuinfo_x86 *c) -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply. --