kernel-janitors.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] thermal/core: Potential buffer overflow in thermal_build_list_of_policies()
@ 2021-09-16 13:13 Dan Carpenter
  2021-09-17  7:54 ` Daniel Lezcano
  0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2021-09-16 13:13 UTC (permalink / raw)
  To: Zhang Rui
  Cc: Daniel Lezcano, Amit Kucheria, Eduardo Valentin, linux-pm,
	kernel-janitors

After printing the list of thermal governors, then this function prints
a newline character.  The problem is that "size" has not been updated
after printing the last governor.  This means that it can write one
character (the NUL terminator) beyond the end of the buffer.

Get rid of the "size" variable and just use "PAGE_SIZE - count" directly.

Fixes: 1b4f48494eb2 ("thermal: core: group functions related to governor handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/thermal/thermal_core.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 97ef9b040b84..51374f4e1cca 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -222,15 +222,14 @@ int thermal_build_list_of_policies(char *buf)
 {
 	struct thermal_governor *pos;
 	ssize_t count = 0;
-	ssize_t size = PAGE_SIZE;
 
 	mutex_lock(&thermal_governor_lock);
 
 	list_for_each_entry(pos, &thermal_governor_list, governor_list) {
-		size = PAGE_SIZE - count;
-		count += scnprintf(buf + count, size, "%s ", pos->name);
+		count += scnprintf(buf + count, PAGE_SIZE - count, "%s ",
+				   pos->name);
 	}
-	count += scnprintf(buf + count, size, "\n");
+	count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
 
 	mutex_unlock(&thermal_governor_lock);
 
-- 
2.20.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] thermal/core: Potential buffer overflow in thermal_build_list_of_policies()
  2021-09-16 13:13 [PATCH] thermal/core: Potential buffer overflow in thermal_build_list_of_policies() Dan Carpenter
@ 2021-09-17  7:54 ` Daniel Lezcano
  0 siblings, 0 replies; 2+ messages in thread
From: Daniel Lezcano @ 2021-09-17  7:54 UTC (permalink / raw)
  To: Dan Carpenter, Zhang Rui
  Cc: Amit Kucheria, Eduardo Valentin, linux-pm, kernel-janitors

On 16/09/2021 15:13, Dan Carpenter wrote:
> After printing the list of thermal governors, then this function prints
> a newline character.  The problem is that "size" has not been updated
> after printing the last governor.  This means that it can write one
> character (the NUL terminator) beyond the end of the buffer.
> 
> Get rid of the "size" variable and just use "PAGE_SIZE - count" directly.
> 
> Fixes: 1b4f48494eb2 ("thermal: core: group functions related to governor handling")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---

Applied, thanks


>  drivers/thermal/thermal_core.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
> index 97ef9b040b84..51374f4e1cca 100644
> --- a/drivers/thermal/thermal_core.c
> +++ b/drivers/thermal/thermal_core.c
> @@ -222,15 +222,14 @@ int thermal_build_list_of_policies(char *buf)
>  {
>  	struct thermal_governor *pos;
>  	ssize_t count = 0;
> -	ssize_t size = PAGE_SIZE;
>  
>  	mutex_lock(&thermal_governor_lock);
>  
>  	list_for_each_entry(pos, &thermal_governor_list, governor_list) {
> -		size = PAGE_SIZE - count;
> -		count += scnprintf(buf + count, size, "%s ", pos->name);
> +		count += scnprintf(buf + count, PAGE_SIZE - count, "%s ",
> +				   pos->name);
>  	}
> -	count += scnprintf(buf + count, size, "\n");
> +	count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
>  
>  	mutex_unlock(&thermal_governor_lock);
>  
> 


-- 
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-09-17  7:54 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-16 13:13 [PATCH] thermal/core: Potential buffer overflow in thermal_build_list_of_policies() Dan Carpenter
2021-09-17  7:54 ` Daniel Lezcano

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).