lkml.org 
[lkml]   [2021]   [Jun]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 03/29] efi: cper: fix snprintf() use in cper_dimm_err_location()
    Date
    From: Rasmus Villemoes <linux@rasmusvillemoes.dk>

    [ Upstream commit 942859d969de7f6f7f2659a79237a758b42782da ]

    snprintf() should be given the full buffer size, not one less. And it
    guarantees nul-termination, so doing it manually afterwards is
    pointless.

    It's even potentially harmful (though probably not in practice because
    CPER_REC_LEN is 256), due to the "return how much would have been
    written had the buffer been big enough" semantics. I.e., if the bank
    and/or device strings are long enough that the "DIMM location ..."
    output gets truncated, writing to msg[n] is a buffer overflow.

    Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
    Fixes: 3760cd20402d4 ("CPER: Adjust code flow of some functions")
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/firmware/efi/cper.c | 4 +---
    1 file changed, 1 insertion(+), 3 deletions(-)

    diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
    index c0e54396f250..dc8d2603612e 100644
    --- a/drivers/firmware/efi/cper.c
    +++ b/drivers/firmware/efi/cper.c
    @@ -257,8 +257,7 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg)
    if (!msg || !(mem->validation_bits & CPER_MEM_VALID_MODULE_HANDLE))
    return 0;

    - n = 0;
    - len = CPER_REC_LEN - 1;
    + len = CPER_REC_LEN;
    dmi_memdev_name(mem->mem_dev_handle, &bank, &device);
    if (bank && device)
    n = snprintf(msg, len, "DIMM location: %s %s ", bank, device);
    @@ -267,7 +266,6 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg)
    "DIMM location: not present. DMI handle: 0x%.4x ",
    mem->mem_dev_handle);

    - msg[n] = '\0';
    return n;
    }

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-06-08 20:31    [W:5.868 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site