[PATCH] powerpc/eeh: NUL-terminate force recovery input

[PATCH] powerpc/eeh: NUL-terminate force recovery input

[Jiale Yao]

eeh_force_recover_write() can fill its entire stack buffer from userspace
and then pass the unterminated data to strncmp() and sscanf(). This can
make the string helpers read beyond the buffer.

Reserve the last byte and initialize the buffer so every accepted input is
NUL-terminated. Propagate copy errors before parsing as well.

Fixes: 954bd99435b8 ("powerpc/eeh: Add eeh_force_recover to debugfs")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 arch/powerpc/kernel/eeh.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index bb836f02101c..2d7898ef6b8c 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -1728,10 +1728,12 @@ static ssize_t eeh_force_recover_write(struct file *filp,
 	struct pci_controller *hose;
 	uint32_t phbid, pe_no;
 	struct eeh_pe *pe;
-	char buf[20];
+	char buf[20] = {};
 	int ret;
 
-	ret = simple_write_to_buffer(buf, sizeof(buf), ppos, user_buf, count);
+	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+	if (ret < 0)
+		return ret;
 	if (!ret)
 		return -EFAULT;
 
-- 
2.34.1

Re: [PATCH] powerpc/eeh: NUL-terminate force recovery input

[Ritesh Harjani]

Jiale Yao <yaojiale02@163.com> writes:

> eeh_force_recover_write() can fill its entire stack buffer from userspace
> and then pass the unterminated data to strncmp() and sscanf(). This can
> make the string helpers read beyond the buffer.
>
> Reserve the last byte and initialize the buffer so every accepted input is
> NUL-terminated. Propagate copy errors before parsing as well.
>
> Fixes: 954bd99435b8 ("powerpc/eeh: Add eeh_force_recover to debugfs")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  arch/powerpc/kernel/eeh.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>

Nice catch! Thanks for fixing it.

LGTM, so please feel free to add:
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>