From patchwork Tue Mar 7 16:53:39 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miquel Raynal X-Patchwork-Id: 660039 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21D11C6FD1A for ; Tue, 7 Mar 2023 16:58:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230300AbjCGQ6d (ORCPT ); Tue, 7 Mar 2023 11:58:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56888 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230035AbjCGQ5x (ORCPT ); Tue, 7 Mar 2023 11:57:53 -0500 Received: from relay6-d.mail.gandi.net (relay6-d.mail.gandi.net [IPv6:2001:4b98:dc4:8::226]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A077C90B65; Tue, 7 Mar 2023 08:54:12 -0800 (PST) Received: (Authenticated sender: miquel.raynal@bootlin.com) by mail.gandi.net (Postfix) with ESMTPSA id 8EDA5C0004; Tue, 7 Mar 2023 16:54:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1678208048; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=75hjPMNAGJRNOFAp/fyez5Ik1I1pAujO7NUPgauoYjM=; b=oJ8WdyTtiPt9WWMz16kTM2WhUvDSZHnxiu7sHpQSkl5i0bNflhYyI//yPMsyOqEa3Ovytc ufbJQMzuPs3WMtvOd3ZVr1BIKia1t7Kog777gMDB7EtVZ+CAfs7z5X9+vHXY+v8km0+6rx nA+np7No6SxiRdjVnKxKlOzwk+W9hmdi32NaaoVU3F7NJjS96feL2RqRZf8Jna8lAmnKNx BneQfPRfZ+ADOFet9i3Zwl//RJO9aLaJqWvOenznN0C0P8CR6xioHfsG69UM7dvENd5DVc jlouF4ECATQGEsQFf3Oj1LwNVmyLsqS6sy1Btg1o0GIwmAAJV05py+d3wZQjYw== From: Miquel Raynal To: Srinivas Kandagatla , Cc: Greg Kroah-Hartman , Michael Walle , =?utf-8?b?UmFmYcWCIE1pxYJlY2tp?= , Robert Marko , Luka Perkov , Thomas Petazzoni , Rob Herring , Frank Rowand , devicetree@vger.kernel.org, Miquel Raynal , Stephen Boyd , Peter Chen , Rob Herring Subject: [PATCH v2 01/21] of: Fix modalias string generation Date: Tue, 7 Mar 2023 17:53:39 +0100 Message-Id: <20230307165359.225361-2-miquel.raynal@bootlin.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230307165359.225361-1-miquel.raynal@bootlin.com> References: <20230307165359.225361-1-miquel.raynal@bootlin.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: devicetree@vger.kernel.org The helper generating an OF based modalias (of_device_get_modalias()) works fine, but due to the use of snprintf() internally it needs a buffer one byte longer than what should be needed just for the entire string (excluding the '\0'). Most users of this helper are sysfs hooks providing the modalias string to users. They all provide a PAGE_SIZE buffer which is way above the number of bytes required to fit the modalias string and hence do not suffer from this issue. There is another user though, of_device_request_module(), which is only called by drivers/usb/common/ulpi.c. This request module function is faulty, but maybe because in most cases there is an alternative, ULPI driver users have not noticed it. In this function, of_device_get_modalias() is called twice. The first time without buffer just to get the number of bytes required by the modalias string (excluding the null byte), and a second time, after buffer allocation, to fill the buffer. The allocation asks for an additional byte, in order to store the trailing '\0'. However, the buffer *length* provided to of_device_get_modalias() excludes this extra byte. The internal use of snprintf() with a length that is exactly the number of bytes to be written has the effect of using the last available byte to store a '\0', which then smashes the last character of the modalias string. Provide the actual size of the buffer to of_device_get_modalias() to fix this issue. Note: the "str[size - 1] = '\0';" line is not really needed as snprintf will anyway end the string with a null byte, but there is a possibility that this function might be called on a struct device_node without compatible, in this case snprintf() would not be executed. So we keep it just to avoid possible unbounded strings. Cc: Stephen Boyd Cc: Peter Chen Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias") Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring --- drivers/of/device.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/of/device.c b/drivers/of/device.c index c674a13c3055..877f50379fab 100644 --- a/drivers/of/device.c +++ b/drivers/of/device.c @@ -297,12 +297,15 @@ int of_device_request_module(struct device *dev) if (size < 0) return size; - str = kmalloc(size + 1, GFP_KERNEL); + /* Reserve an additional byte for the trailing '\0' */ + size++; + + str = kmalloc(size, GFP_KERNEL); if (!str) return -ENOMEM; of_device_get_modalias(dev, str, size); - str[size] = '\0'; + str[size - 1] = '\0'; ret = request_module(str); kfree(str);