On 24 Apr 2024, at 18:54, Luis Chamberlain wrote:
> If the file entry is too long we may easily end up going out of bounds
> and crash after strsep() on sscanf(). To avoid this ensure we bound the
> string to an expected length before we use sscanf() on it.
>
> Signed-off-by: Luis Chamberlain <mcgrof@xxxxxxxxxx>
> ---
> mm/huge_memory.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 9e9879d2f501..8386d24a163e 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -3623,6 +3623,7 @@ static ssize_t split_huge_pages_write(struct file *file, const char __user *buf,
> char file_path[MAX_INPUT_BUF_SZ];
> pgoff_t off_start = 0, off_end = 0;
> size_t input_len = strlen(input_buf);
> + size_t max_left_over;
>
> tok = strsep(&buf, ",");
> if (tok) {
> @@ -3632,6 +3633,14 @@ static ssize_t split_huge_pages_write(struct file *file, const char __user *buf,
> goto out;
> }
>
> + max_left_over = MAX_INPUT_BUF_SZ - strlen(file_path);
> + if (!buf ||
> + strnlen(buf, max_left_over) < 7 ||
What is this magic number 7? strlen("0xN,0xN") as the minimal input string size?
Maybe use sizeof("0xN,0xN") - 1 instead?
> + strnlen(buf, max_left_over) > max_left_over) {
> + ret = -EINVAL;
> + goto out;
> + }
> +
> ret = sscanf(buf, "0x%lx,0x%lx,%d", &off_start, &off_end, &new_order);
> if (ret != 2 && ret != 3) {
> ret = -EINVAL;
> --
> 2.43.0
Everything else looks good to me. Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>
--
Best Regards,
Yan, Zi
Attachment:
signature.asc
Description: OpenPGP digital signature
