iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mmc: core: use sysfs_emit() instead of sprintf()

Browse Source 
sprintf() (still used in the MMC core for the sysfs output) is vulnerable
to the buffer overflow.  Use the new-fangled sysfs_emit() instead.

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.

Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/717729b2-d65b-c72e-9fac-471d28d00b5a@omp.ru
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
This commit is contained in:
Sergey Shtylyov 2022-02-08 15:02:15 +03:00 committed by Ulf Hansson
parent 75a2f412d0
commit f5d8a5fe77
6 changed files with 33 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/mmc/core/bus.c
View File

@ -15,6 +15,7 @@
#include <linux/stat.h> #include <linux/stat.h>
#include <linux/of.h> #include <linux/of.h>
#include <linux/pm_runtime.h> #include <linux/pm_runtime.h>
#include <linux/sysfs.h>
#include <linux/mmc/card.h> #include <linux/mmc/card.h>
#include <linux/mmc/host.h> #include <linux/mmc/host.h>
@ -34,13 +35,13 @@ static ssize_t type_show(struct device *dev,
switch (card->type) { switch (card->type) {
case MMC_TYPE_MMC: case MMC_TYPE_MMC:
return sprintf(buf, "MMC\n"); return sysfs_emit(buf, "MMC\n");
case MMC_TYPE_SD: case MMC_TYPE_SD:
return sprintf(buf, "SD\n"); return sysfs_emit(buf, "SD\n");
case MMC_TYPE_SDIO: case MMC_TYPE_SDIO:
return sprintf(buf, "SDIO\n"); return sysfs_emit(buf, "SDIO\n");
case MMC_TYPE_SD_COMBO: case MMC_TYPE_SD_COMBO:
return sprintf(buf, "SDcombo\n"); return sysfs_emit(buf, "SDcombo\n");
default: default:
return -EFAULT; return -EFAULT;
} }

3
drivers/mmc/core/bus.h
View File

@ -9,6 +9,7 @@
#define _MMC_CORE_BUS_H #define _MMC_CORE_BUS_H
#include <linux/device.h> #include <linux/device.h>
#include <linux/sysfs.h>
struct mmc_host; struct mmc_host;
struct mmc_card; struct mmc_card;
@ -17,7 +18,7 @@ struct mmc_card;
static ssize_t mmc_##name##_show (struct device *dev, struct device_attribute *attr, char *buf) \ static ssize_t mmc_##name##_show (struct device *dev, struct device_attribute *attr, char *buf) \
{ \ { \
struct mmc_card *card = mmc_dev_to_card(dev); \ struct mmc_card *card = mmc_dev_to_card(dev); \
return sprintf(buf, fmt, args); \ return sysfs_emit(buf, fmt, args); \
} \ } \
static DEVICE_ATTR(name, S_IRUGO, mmc_##name##_show, NULL) static DEVICE_ATTR(name, S_IRUGO, mmc_##name##_show, NULL)

16
drivers/mmc/core/mmc.c
View File

@ -12,6 +12,7 @@
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/stat.h> #include <linux/stat.h>
#include <linux/pm_runtime.h> #include <linux/pm_runtime.h>
#include <linux/sysfs.h>
#include <linux/mmc/host.h> #include <linux/mmc/host.h>
#include <linux/mmc/card.h> #include <linux/mmc/card.h>
@ -812,12 +813,11 @@ static ssize_t mmc_fwrev_show(struct device *dev,
{ {
struct mmc_card *card = mmc_dev_to_card(dev); struct mmc_card *card = mmc_dev_to_card(dev);
if (card->ext_csd.rev < 7) { if (card->ext_csd.rev < 7)
return sprintf(buf, "0x%x\n", card->cid.fwrev); return sysfs_emit(buf, "0x%x\n", card->cid.fwrev);
} else { else
return sprintf(buf, "0x%*phN\n", MMC_FIRMWARE_LEN, return sysfs_emit(buf, "0x%*phN\n", MMC_FIRMWARE_LEN,
card->ext_csd.fwrev); card->ext_csd.fwrev);
}
} }
static DEVICE_ATTR(fwrev, S_IRUGO, mmc_fwrev_show, NULL); static DEVICE_ATTR(fwrev, S_IRUGO, mmc_fwrev_show, NULL);
@ -830,10 +830,10 @@ static ssize_t mmc_dsr_show(struct device *dev,
struct mmc_host *host = card->host; struct mmc_host *host = card->host;
if (card->csd.dsr_imp && host->dsr_req) if (card->csd.dsr_imp && host->dsr_req)
return sprintf(buf, "0x%x\n", host->dsr); return sysfs_emit(buf, "0x%x\n", host->dsr);
else else
/* return default DSR value */ /* return default DSR value */
return sprintf(buf, "0x%x\n", 0x404); return sysfs_emit(buf, "0x%x\n", 0x404);
} }
static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL); static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL);

23
drivers/mmc/core/sd.c
View File

@ -13,6 +13,7 @@
#include <linux/stat.h> #include <linux/stat.h>
#include <linux/pm_runtime.h> #include <linux/pm_runtime.h>
#include <linux/scatterlist.h> #include <linux/scatterlist.h>
#include <linux/sysfs.h>
#include <linux/mmc/host.h> #include <linux/mmc/host.h>
#include <linux/mmc/card.h> #include <linux/mmc/card.h>
@ -708,18 +709,16 @@ MMC_DEV_ATTR(ocr, "0x%08x\n", card->ocr);
MMC_DEV_ATTR(rca, "0x%04x\n", card->rca); MMC_DEV_ATTR(rca, "0x%04x\n", card->rca);
static ssize_t mmc_dsr_show(struct device *dev, static ssize_t mmc_dsr_show(struct device *dev, struct device_attribute *attr,
struct device_attribute *attr, char *buf)
char *buf)
{ {
struct mmc_card *card = mmc_dev_to_card(dev); struct mmc_card *card = mmc_dev_to_card(dev);
struct mmc_host *host = card->host; struct mmc_host *host = card->host;
if (card->csd.dsr_imp && host->dsr_req) if (card->csd.dsr_imp && host->dsr_req)
return sprintf(buf, "0x%x\n", host->dsr); return sysfs_emit(buf, "0x%x\n", host->dsr);
else /* return default DSR value */
/* return default DSR value */ return sysfs_emit(buf, "0x%x\n", 0x404);
return sprintf(buf, "0x%x\n", 0x404);
} }
static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL); static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL);
@ -735,9 +734,9 @@ static ssize_t info##num##_show(struct device *dev, struct device_attribute *att
\ \
if (num > card->num_info) \ if (num > card->num_info) \
return -ENODATA; \ return -ENODATA; \
if (!card->info[num-1][0]) \ if (!card->info[num - 1][0]) \
return 0; \ return 0; \
return sprintf(buf, "%s\n", card->info[num-1]); \ return sysfs_emit(buf, "%s\n", card->info[num - 1]); \
} \ } \
static DEVICE_ATTR_RO(info##num) static DEVICE_ATTR_RO(info##num)

5
drivers/mmc/core/sdio.c
View File

@ -7,6 +7,7 @@
#include <linux/err.h> #include <linux/err.h>
#include <linux/pm_runtime.h> #include <linux/pm_runtime.h>
#include <linux/sysfs.h>
#include <linux/mmc/host.h> #include <linux/mmc/host.h>
#include <linux/mmc/card.h> #include <linux/mmc/card.h>
@ -40,9 +41,9 @@ static ssize_t info##num##_show(struct device *dev, struct device_attribute *att
\ \
if (num > card->num_info) \ if (num > card->num_info) \
return -ENODATA; \ return -ENODATA; \
if (!card->info[num-1][0]) \ if (!card->info[num - 1][0]) \
return 0; \ return 0; \
return sprintf(buf, "%s\n", card->info[num-1]); \ return sysfs_emit(buf, "%s\n", card->info[num - 1]); \
} \ } \
static DEVICE_ATTR_RO(info##num) static DEVICE_ATTR_RO(info##num)

7
drivers/mmc/core/sdio_bus.c
View File

@ -14,6 +14,7 @@
#include <linux/pm_runtime.h> #include <linux/pm_runtime.h>
#include <linux/pm_domain.h> #include <linux/pm_domain.h>
#include <linux/acpi.h> #include <linux/acpi.h>
#include <linux/sysfs.h>
#include <linux/mmc/card.h> #include <linux/mmc/card.h>
#include <linux/mmc/host.h> #include <linux/mmc/host.h>
@ -35,7 +36,7 @@ field##_show(struct device *dev, struct device_attribute *attr, char *buf) \
struct sdio_func *func; \ struct sdio_func *func; \
\ \
func = dev_to_sdio_func (dev); \ func = dev_to_sdio_func (dev); \
return sprintf(buf, format_string, args); \ return sysfs_emit(buf, format_string, args); \
} \ } \
static DEVICE_ATTR_RO(field) static DEVICE_ATTR_RO(field)
@ -52,9 +53,9 @@ static ssize_t info##num##_show(struct device *dev, struct device_attribute *att
\ \
if (num > func->num_info) \ if (num > func->num_info) \
return -ENODATA; \ return -ENODATA; \
if (!func->info[num-1][0]) \ if (!func->info[num - 1][0]) \
return 0; \ return 0; \
return sprintf(buf, "%s\n", func->info[num-1]); \ return sysfs_emit(buf, "%s\n", func->info[num - 1]); \
} \ } \
static DEVICE_ATTR_RO(info##num) static DEVICE_ATTR_RO(info##num)