On Wed, Apr 24, 2024 at 09:03:51PM -0400, Zi Yan wrote:
> On 24 Apr 2024, at 18:54, Luis Chamberlain wrote:
>
> > If the file entry is too long we may easily end up going out of bounds
> > and crash after strsep() on sscanf(). To avoid this ensure we bound the
> > string to an expected length before we use sscanf() on it.
> >
> > Signed-off-by: Luis Chamberlain <mcgrof@xxxxxxxxxx>
> > ---
> > mm/huge_memory.c | 9 +++++++++
> > 1 file changed, 9 insertions(+)
> >
> > diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> > index 9e9879d2f501..8386d24a163e 100644
> > --- a/mm/huge_memory.c
> > +++ b/mm/huge_memory.c
> > @@ -3623,6 +3623,7 @@ static ssize_t split_huge_pages_write(struct file *file, const char __user *buf,
> > char file_path[MAX_INPUT_BUF_SZ];
> > pgoff_t off_start = 0, off_end = 0;
> > size_t input_len = strlen(input_buf);
> > + size_t max_left_over;
> >
> > tok = strsep(&buf, ",");
> > if (tok) {
> > @@ -3632,6 +3633,14 @@ static ssize_t split_huge_pages_write(struct file *file, const char __user *buf,
> > goto out;
> > }
> >
> > + max_left_over = MAX_INPUT_BUF_SZ - strlen(file_path);
> > + if (!buf ||
> > + strnlen(buf, max_left_over) < 7 ||
>
> What is this magic number 7? strlen("0xN,0xN") as the minimal input string size?
> Maybe use sizeof("0xN,0xN") - 1 instead?
Sure and I forgot the fixes tag, will send a v2.
Luis
