Commit 08e23d05 authored by Christian Marangi's avatar Christian Marangi Committed by Chanwoo Choi
Browse files

PM / devfreq: Fix buffer overflow in trans_stat_show 

Fix buffer overflow in trans_stat_show().

Convert simple snprintf to the more secure scnprintf with size of
PAGE_SIZE.

Add condition checking if we are exceeding PAGE_SIZE and exit early from
loop. Also add at the end a warning that we exceeded PAGE_SIZE and that
stats is disabled.

Return -EFBIG in the case where we don't have enough space to write the
full transition table.

Also document in the ABI that this function can return -EFBIG error.

Link: https://lore.kernel.org/all/20231024183016.14648-2-ansuelsmth@gmail.com/
Cc: stable@vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218041


Fixes: e552bbaf ("PM / devfreq: Add sysfs node for representing frequency transition information.")
Signed-off-by: default avatarChristian Marangi <ansuelsmth@gmail.com>
Signed-off-by: default avatarChanwoo Choi <cw00.choi@samsung.com>
parent b85ea95d

Documentation/ABI/testing/sysfs-class-devfreq

+3 −0
Original line number Diff line number Diff line
@@ -52,6 +52,9 @@ Description: 


			echo 0 > /sys/class/devfreq/.../trans_stat



		If the transition table is bigger than PAGE_SIZE, reading

		this will return an -EFBIG error.



What:		/sys/class/devfreq/.../available_frequencies

Date:		October 2012

Contact:	Nishanth Menon <nm@ti.com>

drivers/devfreq/devfreq.c

+39 −18
Original line number Diff line number Diff line
@@ -1688,7 +1688,7 @@ static ssize_t trans_stat_show(struct device *dev, 
			       struct device_attribute *attr, char *buf)

{

	struct devfreq *df = to_devfreq(dev);

	ssize_t len;

	ssize_t len = 0;

	int i, j;

	unsigned int max_state;
@@ -1697,7 +1697,7 @@ static ssize_t trans_stat_show(struct device *dev, 
	max_state = df->max_state;



	if (max_state == 0)

		return sprintf(buf, "Not Supported.\n");

		return scnprintf(buf, PAGE_SIZE, "Not Supported.\n");



	mutex_lock(&df->lock);

	if (!df->stop_polling &&
@@ -1707,31 +1707,52 @@ static ssize_t trans_stat_show(struct device *dev, 
	}

	mutex_unlock(&df->lock);



	len = sprintf(buf, "     From  :   To\n");

	len += sprintf(buf + len, "           :");

	for (i = 0; i < max_state; i++)

		len += sprintf(buf + len, "%10lu",

	len += scnprintf(buf + len, PAGE_SIZE - len, "     From  :   To\n");

	len += scnprintf(buf + len, PAGE_SIZE - len, "           :");

	for (i = 0; i < max_state; i++) {

		if (len >= PAGE_SIZE - 1)

			break;

		len += scnprintf(buf + len, PAGE_SIZE - len, "%10lu",

				 df->freq_table[i]);

	}

	if (len >= PAGE_SIZE - 1)

		return PAGE_SIZE - 1;



	len += sprintf(buf + len, "   time(ms)\n");

	len += scnprintf(buf + len, PAGE_SIZE - len, "   time(ms)\n");



	for (i = 0; i < max_state; i++) {

		if (len >= PAGE_SIZE - 1)

			break;

		if (df->freq_table[i] == df->previous_freq)

			len += sprintf(buf + len, "*");

			len += scnprintf(buf + len, PAGE_SIZE - len, "*");

		else

			len += sprintf(buf + len, " ");

			len += scnprintf(buf + len, PAGE_SIZE - len, " ");

		if (len >= PAGE_SIZE - 1)

			break;



		len += sprintf(buf + len, "%10lu:", df->freq_table[i]);

		for (j = 0; j < max_state; j++)

			len += sprintf(buf + len, "%10u",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%10lu:",

				 df->freq_table[i]);

		for (j = 0; j < max_state; j++) {

			if (len >= PAGE_SIZE - 1)

				break;

			len += scnprintf(buf + len, PAGE_SIZE - len, "%10u",

					 df->stats.trans_table[(i * max_state) + j]);



		len += sprintf(buf + len, "%10llu\n", (u64)

		}

		if (len >= PAGE_SIZE - 1)

			break;

		len += scnprintf(buf + len, PAGE_SIZE - len, "%10llu\n", (u64)

				 jiffies64_to_msecs(df->stats.time_in_state[i]));

	}



	len += sprintf(buf + len, "Total transition : %u\n",

	if (len < PAGE_SIZE - 1)

		len += scnprintf(buf + len, PAGE_SIZE - len, "Total transition : %u\n",

				 df->stats.total_trans);



	if (len >= PAGE_SIZE - 1) {

		pr_warn_once("devfreq transition table exceeds PAGE_SIZE. Disabling\n");

		return -EFBIG;

	}



	return len;

}