[PATCH 1/1] libfdt: check return value of fdt_num_mem_rsv() in fdt_pack()

[PATCH 1/1] libfdt: check return value of fdt_num_mem_rsv() in fdt_pack()

[Heinrich Schuchardt]

fdt_num_mem_rsv() may return -FDT_ERR_TRUNCATED.
In this case fdt_pack() should propagate the error code.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
---
 libfdt/fdt_rw.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libfdt/fdt_rw.c b/libfdt/fdt_rw.c
index 3621d36..a307701 100644
--- a/libfdt/fdt_rw.c
+++ b/libfdt/fdt_rw.c
@@ -490,8 +490,11 @@ int fdt_pack(void *fdt)
 
 	FDT_RW_PROBE(fdt);
 
-	mem_rsv_size = (fdt_num_mem_rsv(fdt)+1)
-		* sizeof(struct fdt_reserve_entry);
+	mem_rsv_size = fdt_num_mem_rsv(fdt);
+	if (mem_rsv_size < 0)
+		return mem_rsv_size;
+
+	mem_rsv_size = (mem_rsv_size + 1) * sizeof(struct fdt_reserve_entry);
 	fdt_packblocks_(fdt, fdt, mem_rsv_size, fdt_size_dt_struct(fdt),
 			fdt_size_dt_strings(fdt));
 	fdt_set_totalsize(fdt, fdt_data_size_(fdt));
-- 
2.45.2

Re: [PATCH] libfdt: check return value of fdt_num_mem_rsv() in fdt_pack()

[Markus Elfring]

> fdt_num_mem_rsv() may return -FDT_ERR_TRUNCATED.
> In this case fdt_pack() should propagate the error code.

1. Please choose imperative wordings for an improved change description.
   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.10-rc6#n94

2. Would you like to add any tags (like “Fixes” and “Cc”)?

3. How do you think about to use a summary phrase like “Complete error handling
   in fdt_pack()”?


Regards,
Markus

Re: [PATCH 1/1] libfdt: check return value of fdt_num_mem_rsv() in fdt_pack()

[Rob Herring]

On Mon, Jul 1, 2024 at 3:55 PM Heinrich Schuchardt
<heinrich.schuchardt@canonical.com> wrote:
>
> fdt_num_mem_rsv() may return -FDT_ERR_TRUNCATED.
> In this case fdt_pack() should propagate the error code.
>
> Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
> ---
>  libfdt/fdt_rw.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)

This needs to be sent to David G and devicetree-compiler list to be applied.

>
> diff --git a/libfdt/fdt_rw.c b/libfdt/fdt_rw.c
> index 3621d36..a307701 100644
> --- a/libfdt/fdt_rw.c
> +++ b/libfdt/fdt_rw.c
> @@ -490,8 +490,11 @@ int fdt_pack(void *fdt)
>
>         FDT_RW_PROBE(fdt);
>
> -       mem_rsv_size = (fdt_num_mem_rsv(fdt)+1)
> -               * sizeof(struct fdt_reserve_entry);
> +       mem_rsv_size = fdt_num_mem_rsv(fdt);
> +       if (mem_rsv_size < 0)
> +               return mem_rsv_size;
> +
> +       mem_rsv_size = (mem_rsv_size + 1) * sizeof(struct fdt_reserve_entry);
>         fdt_packblocks_(fdt, fdt, mem_rsv_size, fdt_size_dt_struct(fdt),
>                         fdt_size_dt_strings(fdt));
>         fdt_set_totalsize(fdt, fdt_data_size_(fdt));
> --
> 2.45.2
>
>

Re: [PATCH] libfdt: check return value of fdt_num_mem_rsv() in fdt_pack()

[Heinrich Schuchardt]

On 7/2/24 14:54, Markus Elfring wrote:
>> fdt_num_mem_rsv() may return -FDT_ERR_TRUNCATED.
>> In this case fdt_pack() should propagate the error code.
> 
> 1. Please choose imperative wordings for an improved change description.
>     https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.10-rc6#n94

The current subject is an imperative?

> 
> 2. Would you like to add any tags (like “Fixes” and “Cc”)?

d5db5382c5e5 ("libfdt: Safer access to memory reservations") introduced 
the check that returns the error code. But before that we could simply 
overrun the buffer. I would not know which patch to blame.

Whom do you want to Cc?

> 
> 3. How do you think about to use a summary phrase like “Complete error handling
>     in fdt_pack()”?
> 

Why should I choose a less specific subject?

Best regards

Heinrich

Re: [PATCH 1/1] libfdt: check return value of fdt_num_mem_rsv() in fdt_pack()

[Heinrich Schuchardt]

On 7/2/24 19:31, Rob Herring wrote:
> On Mon, Jul 1, 2024 at 3:55 PM Heinrich Schuchardt
> <heinrich.schuchardt@canonical.com> wrote:
>>
>> fdt_num_mem_rsv() may return -FDT_ERR_TRUNCATED.
>> In this case fdt_pack() should propagate the error code.
>>
>> Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
>> ---
>>   libfdt/fdt_rw.c | 7 +++++--
>>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> This needs to be sent to David G and devicetree-compiler list to be applied.

Thanks Rob.

I should not have looked in Linux' MAINTAINERS file but into dtc's 
README.md.

Best regards

Heinrich

> 
>>
>> diff --git a/libfdt/fdt_rw.c b/libfdt/fdt_rw.c
>> index 3621d36..a307701 100644
>> --- a/libfdt/fdt_rw.c
>> +++ b/libfdt/fdt_rw.c
>> @@ -490,8 +490,11 @@ int fdt_pack(void *fdt)
>>
>>          FDT_RW_PROBE(fdt);
>>
>> -       mem_rsv_size = (fdt_num_mem_rsv(fdt)+1)
>> -               * sizeof(struct fdt_reserve_entry);
>> +       mem_rsv_size = fdt_num_mem_rsv(fdt);
>> +       if (mem_rsv_size < 0)
>> +               return mem_rsv_size;
>> +
>> +       mem_rsv_size = (mem_rsv_size + 1) * sizeof(struct fdt_reserve_entry);
>>          fdt_packblocks_(fdt, fdt, mem_rsv_size, fdt_size_dt_struct(fdt),
>>                          fdt_size_dt_strings(fdt));
>>          fdt_set_totalsize(fdt, fdt_data_size_(fdt));
>> --
>> 2.45.2
>>
>>

Re: libfdt: check return value of fdt_num_mem_rsv() in fdt_pack()

[Markus Elfring]

>>> fdt_num_mem_rsv() may return -FDT_ERR_TRUNCATED.
>>> In this case fdt_pack() should propagate the error code.
>>
>> 1. Please choose imperative wordings for an improved change description.
>>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.10-rc6#n94
>
> The current subject is an imperative?

Yes.

The requirement for “imperative mood” affects mostly the commit message (or “changelog”),
doesn't it?


>> 2. Would you like to add any tags (like “Fixes” and “Cc”)?
>
> d5db5382c5e5 ("libfdt: Safer access to memory reservations") introduced the check that returns the error code. But before that we could simply overrun the buffer.

Would an other commit be a more appropriate reference?


> I would not know which patch to blame.

Please take another look at a corresponding information source:
https://github.com/dgibson/dtc/blame/main/libfdt/fdt_rw.c#L487-L500

Update candidate:
libfdt: Handle v16 and re-ordered trees for r/w
2007-11-01
https://github.com/dgibson/dtc/commit/a041dcdc48453f26b76bccdb5e2a1ebb3a0ea987#diff-1a98f2be127ff35ab7183bdae1e010189c9992b3bd6e6779fa7b7e451bf72ac4R382


> Whom do you want to Cc?

I suggest to take another look at corresponding information sources.

* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v6.10-rc6#n34

* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.10-rc6#n458


>> 3. How do you think about to use a summary phrase like “Complete error handling
>>    in fdt_pack()”?
>
> Why should I choose a less specific subject?

You would like to improve the error detection and corresponding exception handling another bit,
wouldn't you?

* https://cwe.mitre.org/data/definitions/252.html

* https://wiki.sei.cmu.edu/confluence/display/c/EXP12-C.+Do+not+ignore+values+returned+by+functions


Regards,
Markus