gb_hid_set_report() sizes its request payload as sizeof(*request) + len -
1, but report[] in struct gb_hid_set_report_request is a flexible array
member that sizeof() already excludes. The buffer is therefore one byte too
small, so memcpy(request->report, buf, len) writes one byte past its end,
which KASAN reports as a slab-out-of-bounds write. Drop the stray - 1 so
the allocation covers the whole report.
Closes: https://lore.kernel.org/all/CA+0ovCgLrz4WhPKP5LGW5HZa8VOodgeo6pWuyQGgHE7UY5…
Signed-off-by: Farhad Alemi <farhad.alemi(a)berkeley.edu>
---
The device was emulated.
--- a/drivers/staging/greybus/hid.c
+++ b/drivers/staging/greybus/hid.c
@@ -97,7 +97,8 @@ static int gb_hid_set_report(struct gb_hid *ghid, u8
report_type, u8 report_id,
{
struct gb_hid_set_report_request *request;
struct gb_operation *operation;
- int ret, size = sizeof(*request) + len - 1;
+ /* report[] is a flexible array, so sizeof() already excludes it. */
+ int ret, size = sizeof(*request) + len;
ret = gb_pm_runtime_get_sync(ghid->bundle);
if (ret)
The debugfs buffers in gb_camera (data[PAGE_SIZE], length) are written
with sprintf without any bounds checking. The four places in
gb_camera_debugfs_capabilities, gb_camera_debugfs_configure_streams and
gb_camera_debugfs_flush do:
buffer->length += sprintf(buffer->data + buffer->length, ...);
buffer->length = sprintf(buffer->data, ...);
If the formatted data ever grows (e.g., more streams, larger hex dump)
or if length is already close to PAGE_SIZE, this will overrun the
PAGE_SIZE buffer and corrupt memory. The driver is debugfs-only so
the impact is limited, but it is still a real bug and the pattern is
repeated in multiple places.
Fix it by using scnprintf with the remaining size:
scnprintf(buffer->data + buffer->length, PAGE_SIZE - buffer->length, ...)
scnprintf(buffer->data, PAGE_SIZE, ...)
This is the standard way to write to a fixed-size buffer in the
kernel. It guarantees we never write past PAGE_SIZE and will truncate
instead of overrunning, which is safe for debugfs output. The return
value still accumulates in length, which matches the existing use with
simple_read_from_buffer (it will just show truncated output rather
than corrupting).
I checked that this exact conversion has not been proposed before:
the recent greybus conversions to sysfs_emit (light.c, gbphy.c) and
fbtft/vme_tsi148 scnprintf patches do not touch camera.c at all,
and a search of lore for "gb_camera_debugfs" shows no prior patch
for these four sprintf sites.
No functional change for normal sizes, just makes the code safe if
the buffer ever fills up.
Signed-off-by: Vaibhav Agarwal <contectforbusiness(a)proton.me>
---
drivers/staging/greybus/camera.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c
index 62b55bb28..efc83ceff 100644
--- a/drivers/staging/greybus/camera.c
+++ b/drivers/staging/greybus/camera.c
@@ -890,7 +890,8 @@ static ssize_t gb_camera_debugfs_capabilities(struct gb_camera *gcam,
for (i = 0; i < size; i += 16) {
unsigned int nbytes = min_t(unsigned int, size - i, 16);
- buffer->length += sprintf(buffer->data + buffer->length,
+ buffer->length += scnprintf(buffer->data + buffer->length,
+ PAGE_SIZE - buffer->length,
"%*ph\n", nbytes, caps + i);
}
@@ -973,12 +974,13 @@ static ssize_t gb_camera_debugfs_configure_streams(struct gb_camera *gcam,
if (ret < 0)
goto done;
- buffer->length = sprintf(buffer->data, "%u;%u;", nstreams, flags);
+ buffer->length = scnprintf(buffer->data, PAGE_SIZE, "%u;%u;", nstreams, flags);
for (i = 0; i < nstreams; ++i) {
struct gb_camera_stream_config *stream = &streams[i];
- buffer->length += sprintf(buffer->data + buffer->length,
+ buffer->length += scnprintf(buffer->data + buffer->length,
+ PAGE_SIZE - buffer->length,
"%u;%u;%u;%u;%u;%u;%u;",
stream->width, stream->height,
stream->format, stream->vc,
@@ -1046,7 +1048,7 @@ static ssize_t gb_camera_debugfs_flush(struct gb_camera *gcam,
if (ret < 0)
return ret;
- buffer->length = sprintf(buffer->data, "%u", req_id);
+ buffer->length = scnprintf(buffer->data, PAGE_SIZE, "%u", req_id);
return len;
}
Adhere to Linux kernel coding style. Reported by checkpatch:
CHECK: Alignment should match open parenthesis
Signed-off-by: S Tarun Kumar Lywait <tarun.k.lywait(a)gmail.com>
---
drivers/staging/greybus/camera.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c
index 62b55bb28408..9853bd60ff27 100644
--- a/drivers/staging/greybus/camera.c
+++ b/drivers/staging/greybus/camera.c
@@ -263,9 +263,10 @@ static int gb_camera_get_max_pkt_size(struct gb_camera *gcam,
* Validate the stream configuration response verifying padding is correctly
* set and the returned number of streams is supported
*/
-static const int gb_camera_configure_streams_validate_response(struct gb_camera *gcam,
- struct gb_camera_configure_streams_response *resp,
- unsigned int nstreams)
+static const int gb_camera_configure_streams_validate_response
+ (struct gb_camera *gcam,
+ struct gb_camera_configure_streams_response *resp,
+ unsigned int nstreams)
{
unsigned int i;
--
2.47.3