The patch titled
Subject: libfs: fix error format in simple_attr_write()
has been added to the -mm mm-nonmm-unstable branch. Its filename is
libfs-fix-error-format-in-simple_attr_write.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/libfs-fix-error-format-in-simple_attr_write.patch
This patch will later appear in the mm-nonmm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Eliav Farber <farbere@xxxxxxxxxx>
Subject: libfs: fix error format in simple_attr_write()
Date: Thu, 15 Sep 2022 09:15:44 +0000
In commit 488dac0c9237 ("libfs: fix error cast of negative value in
simple_attr_write()"), simple_attr_write() was changed to use kstrtoull()
instead of simple_strtoll() to convert a string got from a user. A user
trying to set a negative value will get an error.
This is wrong since it breaks all the places that use
DEFINE_DEBUGFS_ATTRIBUTE() with format of a signed integer.
For the record there are 43 current users of signed integer which are
likely to be effected by this:
$ git grep -n -A1 -w DEFINE_DEBUGFS_ATTRIBUTE | grep ');' |
sed 's,.*\(".*%.*"\).*,\1,' | sort | uniq -c
1 "%08llx\n"
5 "0x%016llx\n"
5 "0x%02llx\n"
5 "0x%04llx\n"
13 "0x%08llx\n"
1 "0x%4.4llx\n"
3 "0x%.4llx\n"
4 "0x%llx\n"
1 "%1lld\n"
40 "%lld\n"
2 "%lli\n"
129 "%llu\n"
1 "%#llx\n"
2 "%llx\n"
u64 is not an issue for negative numbers.
The %lld and %llu in any case are for 64-bit value, representing it as
unsigned simplifies the generic code, but it doesn't mean we can't keep
their signed value if we know that.
This change uses sscanf() to fix the problem since it does the conversion
based on the supplied format string.
Link: https://lkml.kernel.org/r/20220915091544.42767-1-farbere@xxxxxxxxxx
Fixes: 488dac0c9237 ("libfs: fix error cast of negative value in simple_attr_write()")
Signed-off-by: Eliav Farber <farbere@xxxxxxxxxx>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxx>
Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: Hanna Hawa <hhhawa@xxxxxxxxxx>
Cc: Jonathan Chocron <jonnyc@xxxxxxxxxx>
Cc: Yicong Yang <yangyicong@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/libfs.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/fs/libfs.c~libfs-fix-error-format-in-simple_attr_write
+++ a/fs/libfs.c
@@ -1017,9 +1017,12 @@ ssize_t simple_attr_write(struct file *f
goto out;
attr->set_buf[size] = '\0';
- ret = kstrtoull(attr->set_buf, 0, &val);
- if (ret)
+ ret = sscanf(attr->set_buf, attr->fmt, &val);
+ if (ret != 1) {
+ ret = -EINVAL;
goto out;
+ }
+
ret = attr->set(attr->data, val);
if (ret == 0)
ret = len; /* on success, claim we got the whole input */
_
Patches currently in -mm which might be from farbere@xxxxxxxxxx are
libfs-fix-error-format-in-simple_attr_write.patch
