[patch] mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()

[patch] mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()

[Dan Carpenter]

We always put a NUL terminator one space past the end of the "vendor"
buffer.  Also I think the strnlen() limiter is off by one so I have made
it smaller.

Fixes: 7d17c02a01a1 ('mtd: Add new SmartMedia/xD FTL')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Static analysis stuff.  Untested.

diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
index 4b8e89583f2a..7c452714df8d 100644
--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
@@ -59,11 +59,12 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
 	struct attribute_group *attr_group;
 	struct attribute **attributes;
 	struct sm_sysfs_attribute *vendor_attribute;
+	int vendor_len;
+	char *vendor;
 
-	int vendor_len = strnlen(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,
-					SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET);
-
-	char *vendor = kmalloc(vendor_len, GFP_KERNEL);
+	vendor_len = strnlen(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,
+			     SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET - 1);
+	vendor = kmalloc(vendor_len + 1, GFP_KERNEL);
 	if (!vendor)
 		goto error1;
 	memcpy(vendor, ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, vendor_len);

Re: [patch] mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()

[walter harms]

Am 05.12.2013 12:02, schrieb Dan Carpenter:
> We always put a NUL terminator one space past the end of the "vendor"
> buffer.  Also I think the strnlen() limiter is off by one so I have made
> it smaller.
> 
> Fixes: 7d17c02a01a1 ('mtd: Add new SmartMedia/xD FTL')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Static analysis stuff.  Untested.
> 
> diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
> index 4b8e89583f2a..7c452714df8d 100644
> --- a/drivers/mtd/sm_ftl.c
> +++ b/drivers/mtd/sm_ftl.c
> @@ -59,11 +59,12 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
>  	struct attribute_group *attr_group;
>  	struct attribute **attributes;
>  	struct sm_sysfs_attribute *vendor_attribute;
> +	int vendor_len;
> +	char *vendor;
>  
> -	int vendor_len = strnlen(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,
> -					SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET);
> -
> -	char *vendor = kmalloc(vendor_len, GFP_KERNEL);
> +	vendor_len = strnlen(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,
> +			     SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET - 1);
> +	vendor = kmalloc(vendor_len + 1, GFP_KERNEL);
>  	if (!vendor)
>  		goto error1;
>  	memcpy(vendor, ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, vendor_len);

Hi Dan,
is this a case for kstr(n)dup() ? like:

int maxlen=SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET-1;
char *buf=ftl->cis_buffer + SM_CIS_VENDOR_OFFSET;
vendor=kstrndup(buf,maxlen,GFP_KERNEL);
if (!vendor)
	goto error1;

i added maxlen, buf to to help me understand the code,
when the source is save kstrdup() is also an option

just my to cents,
 wh

Re: [patch] mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()

[Dan Carpenter]

Yeah, good point.  kstrndup() is cleaner.  I will resend.

regards,
dan carpenter

[patch v2] mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()

[Dan Carpenter]

We always put a NUL terminator one space past the end of the "vendor"
buffer.  Walter Harms also pointed out that this should just use
kstrndup().

Fixes: 7d17c02a01a1 ('mtd: Add new SmartMedia/xD FTL')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2:  Use kstrndup().
     Don't subtract 1 from the strnlen() limiter for the NUL.  I think
     it's ok to go over?

diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
index 4b8e89583f2a..cf49c22673b9 100644
--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
@@ -59,15 +59,12 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
 	struct attribute_group *attr_group;
 	struct attribute **attributes;
 	struct sm_sysfs_attribute *vendor_attribute;
+	char *vendor;
 
-	int vendor_len = strnlen(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,
-					SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET);
-
-	char *vendor = kmalloc(vendor_len, GFP_KERNEL);
+	vendor = kstrndup(ftl->cis_buffer + SM_CIS_VENDOR_OFFSET,
+			  SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET, GFP_KERNEL);
 	if (!vendor)
 		goto error1;
-	memcpy(vendor, ftl->cis_buffer + SM_CIS_VENDOR_OFFSET, vendor_len);
-	vendor[vendor_len] = 0;
 
 	/* Initialize sysfs attributes */
 	vendor_attribute =
@@ -78,7 +75,7 @@ static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
 	sysfs_attr_init(&vendor_attribute->dev_attr.attr);
 
 	vendor_attribute->data = vendor;
-	vendor_attribute->len = vendor_len;
+	vendor_attribute->len = strlen(vendor);
 	vendor_attribute->dev_attr.attr.name = "vendor";
 	vendor_attribute->dev_attr.attr.mode = S_IRUGO;
 	vendor_attribute->dev_attr.show = sm_attr_show;

Re: [patch v2] mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()

[Brian Norris]

On Thu, Dec 05, 2013 at 05:53:50PM +0300, Dan Carpenter wrote:
> We always put a NUL terminator one space past the end of the "vendor"
> buffer.  Walter Harms also pointed out that this should just use
> kstrndup().
> 
> Fixes: 7d17c02a01a1 ('mtd: Add new SmartMedia/xD FTL')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Patch looks good.

> ---
> v2:  Use kstrndup().
>      Don't subtract 1 from the strnlen() limiter for the NUL.  I think
>      it's ok to go over?

I don't think you're "going over" anything. You're just (correctly)
allocating the buffer as (at most) one byte larger than (SM_SMALL_PAGE -
SM_CIS_VENDOR_OFFSET), which is perfect if you're copying up to
(SM_SMALL_PAGE - SM_CIS_VENDOR_OFFSET) bytes of character data.

Pushed to l2-mtd.git/next, queued for 3.15. Thanks.

Brian