* [PATCH] drm/xe: replace format-less snprintf() with strscpy()
@ 2024-05-28 13:32 Arnd Bergmann
2024-05-28 14:46 ` Thomas Hellström
0 siblings, 1 reply; 2+ messages in thread
From: Arnd Bergmann @ 2024-05-28 13:32 UTC (permalink / raw)
To: Lucas De Marchi, Oded Gabbay, Thomas Hellström
Cc: Arnd Bergmann, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Daniel Vetter, Rodrigo Vivi,
José Roberto de Souza, Matthew Brost, Francois Dugast,
Himal Prasad Ghimiray, intel-xe, dri-devel, linux-kernel
From: Arnd Bergmann <arnd@arndb.de>
Using snprintf() with a format string from task->comm is a bit
dangerous since the string may be controlled by unprivileged
userspace:
drivers/gpu/drm/xe/xe_devcoredump.c: In function 'devcoredump_snapshot':
drivers/gpu/drm/xe/xe_devcoredump.c:184:9: error: format not a string literal and no format arguments [-Werror=format-security]
184 | snprintf(ss->process_name, sizeof(ss->process_name), process_name);
| ^~~~~~~~
In this case there is no reason for an snprintf(), so use a simpler
string copy.
Fixes: b10d0c5e9df7 ("drm/xe: Add process name to devcoredump")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
drivers/gpu/drm/xe/xe_devcoredump.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/xe_devcoredump.c
index 1643d44f8bc4..1973bfaece40 100644
--- a/drivers/gpu/drm/xe/xe_devcoredump.c
+++ b/drivers/gpu/drm/xe/xe_devcoredump.c
@@ -181,7 +181,7 @@ static void devcoredump_snapshot(struct xe_devcoredump *coredump,
if (task)
process_name = task->comm;
}
- snprintf(ss->process_name, sizeof(ss->process_name), process_name);
+ strscpy(ss->process_name, process_name);
if (task)
put_task_struct(task);
--
2.39.2
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] drm/xe: replace format-less snprintf() with strscpy()
2024-05-28 13:32 [PATCH] drm/xe: replace format-less snprintf() with strscpy() Arnd Bergmann
@ 2024-05-28 14:46 ` Thomas Hellström
0 siblings, 0 replies; 2+ messages in thread
From: Thomas Hellström @ 2024-05-28 14:46 UTC (permalink / raw)
To: Arnd Bergmann, Lucas De Marchi, Oded Gabbay
Cc: Arnd Bergmann, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Daniel Vetter, Rodrigo Vivi,
José Roberto de Souza, Matthew Brost, Francois Dugast,
Himal Prasad Ghimiray, intel-xe, dri-devel, linux-kernel
On Tue, 2024-05-28 at 15:32 +0200, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> Using snprintf() with a format string from task->comm is a bit
> dangerous since the string may be controlled by unprivileged
> userspace:
>
> drivers/gpu/drm/xe/xe_devcoredump.c: In function
> 'devcoredump_snapshot':
> drivers/gpu/drm/xe/xe_devcoredump.c:184:9: error: format not a string
> literal and no format arguments [-Werror=format-security]
> 184 | snprintf(ss->process_name, sizeof(ss->process_name),
> process_name);
> | ^~~~~~~~
>
> In this case there is no reason for an snprintf(), so use a simpler
> string copy.
>
> Fixes: b10d0c5e9df7 ("drm/xe: Add process name to devcoredump")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Thanks,
Will pick up and apply as soon as our CI is fit for fight.
/Thomas
> ---
> drivers/gpu/drm/xe/xe_devcoredump.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c
> b/drivers/gpu/drm/xe/xe_devcoredump.c
> index 1643d44f8bc4..1973bfaece40 100644
> --- a/drivers/gpu/drm/xe/xe_devcoredump.c
> +++ b/drivers/gpu/drm/xe/xe_devcoredump.c
> @@ -181,7 +181,7 @@ static void devcoredump_snapshot(struct
> xe_devcoredump *coredump,
> if (task)
> process_name = task->comm;
> }
> - snprintf(ss->process_name, sizeof(ss->process_name),
> process_name);
> + strscpy(ss->process_name, process_name);
> if (task)
> put_task_struct(task);
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-05-28 14:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-05-28 13:32 [PATCH] drm/xe: replace format-less snprintf() with strscpy() Arnd Bergmann
2024-05-28 14:46 ` Thomas Hellström
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox