On Thu, Feb 11, 2021 at 11:53:24AM +0200, Andy Shevchenko wrote:
> On Thu, Feb 11, 2021 at 10:09 AM Geert Uytterhoeven
> <ge...@linux-m68k.org> wrote:
> > On Wed, Feb 10, 2021 at 11:33 PM Drew Fustini <d...@beagleboard.org> wrote:
>
>
> > > +#define PINMUX_MAX_NAME 64
>
> > > + if (len > (PINMUX_MAX_NAME * 2)) {
> > > + dev_err(pctldev->dev, "write too big for buffer");
> > > + return -EINVAL;
> > > + }
> > > +
> > > + buf = kzalloc(PINMUX_MAX_NAME * 2, GFP_KERNEL);
>
> > > + ret = strncpy_from_user(buf, user_buf, PINMUX_MAX_NAME * 2);
> >
> > While this guarantees buf is not overflowed...
> >
> > > + if (ret < 0) {
> > > + dev_err(pctldev->dev, "failed to copy buffer from
> > > userspace");
> > > + goto free_gname;
> > > + }
> > > + buf[len-1] = '\0';
> > > +
> > > + ret = sscanf(buf, "%s %s", fname, gname);
> >
> > ... one of the two strings can still be longer than PINMUX_MAX_NAME,
> > thus overflowing fname or gname.
> >
> > As buf is already a copy, it may be easier to just find the strings in
> > buf, write the NUL terminators into buf, and set up fname and gname
> > to point to the strings inside buf.
>
> You beat me up to it. I was about to comment the same.
>
> So, indeed, instead of sscanf it's simply better and faster to do just
> something like
>
> fname = strstrip(buf) ;
> if (*fname == '\0') {
> ...
> return -EINVAL;
> }
>
> gname = strchr(fname, ' ');
> if (!gname) {
> ...
> return -EINVAL;
> }
> *gname++ = '\0';
>
> on top of the buf pointer.
>
Thank you for the suggestion about how to implement this. I'll use that
in the next revision.
-Drew
