Patch "modpost: remove incorrect code in do_eisa_entry()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    modpost: remove incorrect code in do_eisa_entry()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     modpost-remove-incorrect-code-in-do_eisa_entry.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 21b9d35ca0180ba631c04ec04f75354a6ee9eb90
Author: Masahiro Yamada <masahiroy@xxxxxxxxxx>
Date:   Wed Nov 20 08:56:39 2024 +0900

    modpost: remove incorrect code in do_eisa_entry()
    
    [ Upstream commit 0c3e091319e4748cb36ac9a50848903dc6f54054 ]
    
    This function contains multiple bugs after the following commits:
    
     - ac551828993e ("modpost: i2c aliases need no trailing wildcard")
     - 6543becf26ff ("mod/file2alias: make modalias generation safe for cross compiling")
    
    Commit ac551828993e inserted the following code to do_eisa_entry():
    
        else
                strcat(alias, "*");
    
    This is incorrect because 'alias' is uninitialized. If it is not
    NULL-terminated, strcat() could cause a buffer overrun.
    
    Even if 'alias' happens to be zero-filled, it would output:
    
        MODULE_ALIAS("*");
    
    This would match anything. As a result, the module could be loaded by
    any unrelated uevent from an unrelated subsystem.
    
    Commit ac551828993e introduced another bug.            
    
    Prior to that commit, the conditional check was:
    
        if (eisa->sig[0])
    
    This checked if the first character of eisa_device_id::sig was not '\0'.
    
    However, commit ac551828993e changed it as follows:
    
        if (sig[0])
    
    sig[0] is NOT the first character of the eisa_device_id::sig. The
    type of 'sig' is 'char (*)[8]', meaning that the type of 'sig[0]' is
    'char [8]' instead of 'char'. 'sig[0]' and 'symval' refer to the same
    address, which never becomes NULL.
    
    The correct conversion would have been:
    
        if ((*sig)[0])
    
    However, this if-conditional was meaningless because the earlier change
    in commit ac551828993e was incorrect.
    
    This commit removes the entire incorrect code, which should never have
    been executed.
    
    Fixes: ac551828993e ("modpost: i2c aliases need no trailing wildcard")
    Fixes: 6543becf26ff ("mod/file2alias: make modalias generation safe for cross compiling")
    Signed-off-by: Masahiro Yamada <masahiroy@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 23e7102abe0cd..d911485646c5c 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -799,10 +799,7 @@ static int do_eisa_entry(const char *filename, void *symval,
 		char *alias)
 {
 	DEF_FIELD_ADDR(symval, eisa_device_id, sig);
-	if (sig[0])
-		sprintf(alias, EISA_DEVICE_MODALIAS_FMT "*", *sig);
-	else
-		strcat(alias, "*");
+	sprintf(alias, EISA_DEVICE_MODALIAS_FMT "*", *sig);
 	return 1;
 }