2006-08-20 14:47:31

by Julio Auto

[permalink] [raw]
Subject: [PATCH] 2.6.17.9 Incorrect string length checking in param_set_copystring()

As for 2.6.17.9, linux/include/linux/moduleparam.h suggests the user
of module_param_string() to set the maxlen parameter to
strlen(string), ie. '\0' excluded. However the function that actually
sets the string (param_set_copystring()), doesn't accept inputs with
maxlen-1 characters, reporting that the supplied string should fit
maxlen-1 chars.
See patch below.
Cheers,

Julio Auto

--- linux-2.6.17.9/kernel/params.c.old 2006-08-19 20:48:30.000000000 -0700
+++ linux-2.6.17.9/kernel/params.c 2006-08-19 20:49:15.000000000 -0700
@@ -351,9 +351,9 @@ int param_set_copystring(const char *val
{
struct kparam_string *kps = kp->arg;

- if (strlen(val)+1 > kps->maxlen) {
+ if (strlen(val) > kps->maxlen) {
printk(KERN_ERR "%s: string doesn't fit in %u chars.\n",
- kp->name, kps->maxlen-1);
+ kp->name, kps->maxlen);
return -ENOSPC;
}
strcpy(kps->string, val);


2006-08-20 16:17:53

by Julio Auto

[permalink] [raw]
Subject: Re: [PATCH] 2.6.17.9 Incorrect string length checking in param_set_copystring()

> As for 2.6.17.9, linux/include/linux/moduleparam.h suggests the user
> of module_param_string() to set the maxlen parameter to
> strlen(string), ie. '\0' excluded.

Actually, sizeof(string), not strlen(string). Senseless typo here.
Sorry, my bad. :)

Cheers,

Julio Auto

2006-08-20 21:14:35

by Luca Tettamanti

[permalink] [raw]
Subject: Re: [PATCH] 2.6.17.9 Incorrect string length checking in param_set_copystring()

Julio Auto <[email protected]> ha scritto:
> As for 2.6.17.9, linux/include/linux/moduleparam.h suggests the user
> of module_param_string() to set the maxlen parameter to
> strlen(string), ie. '\0' excluded. However the function that actually
> sets the string (param_set_copystring()), doesn't accept inputs with
> maxlen-1 characters, reporting that the supplied string should fit
> maxlen-1 chars.
> See patch below.
> Cheers,
>
> Julio Auto
>
> --- linux-2.6.17.9/kernel/params.c.old 2006-08-19 20:48:30.000000000 -0700
> +++ linux-2.6.17.9/kernel/params.c 2006-08-19 20:49:15.000000000 -0700
> @@ -351,9 +351,9 @@ int param_set_copystring(const char *val
> {
> struct kparam_string *kps = kp->arg;
>
> - if (strlen(val)+1 > kps->maxlen) {
> + if (strlen(val) > kps->maxlen) {
> printk(KERN_ERR "%s: string doesn't fit in %u chars.\n",
> - kp->name, kps->maxlen-1);
> + kp->name, kps->maxlen);
> return -ENOSPC;
> }
> strcpy(kps->string, val);

Hi,
I believe that the code is correct. kps->maxlen is the lenght of the
buffer; when dealing with a string of N chars you need an array of (N +
1) bytes in order to store the terminator ('\0').

Look again at the check:

if (strlen(val) > kps->maxlen) {

Suppose that val is a string of 10 chars (strlen(val) == 10), suppose
that the buffer holds 10 bytes (kps->maxlen == 10). The expression:

if (10 > 10) {

is false, so strcpy() ends up writing 11 bytes in a buffer of 10 bytes.

Also, for future patches see point 11 of
Documentation/SubmittingPatches.

Luca
--
Home: http://kronoz.cjb.net
"Su cio` di cui non si puo` parlare e` bene tacere".
Ludwig Wittgenstein

2006-08-20 21:39:46

by Julio Auto

[permalink] [raw]
Subject: Re: [PATCH] 2.6.17.9 Incorrect string length checking in param_set_copystring()

First of all, thanks for the reply. I'll take the afore mentioned
point of SubmittingPatches in consideration in the future.

And yes, you're correct.
I was misled by an incorrect use of sizeof() and it made believe that
its return would strip the null terminator. Once again, my bad. :)

Julio Auto

On 8/20/06, Luca <[email protected]> wrote:
> Julio Auto <[email protected]> ha scritto:
> > As for 2.6.17.9, linux/include/linux/moduleparam.h suggests the user
> > of module_param_string() to set the maxlen parameter to
> > strlen(string), ie. '\0' excluded. However the function that actually
> > sets the string (param_set_copystring()), doesn't accept inputs with
> > maxlen-1 characters, reporting that the supplied string should fit
> > maxlen-1 chars.
> > See patch below.
> > Cheers,
> >
> > Julio Auto
> >
> > --- linux-2.6.17.9/kernel/params.c.old 2006-08-19 20:48:30.000000000 -0700
> > +++ linux-2.6.17.9/kernel/params.c 2006-08-19 20:49:15.000000000 -0700
> > @@ -351,9 +351,9 @@ int param_set_copystring(const char *val
> > {
> > struct kparam_string *kps = kp->arg;
> >
> > - if (strlen(val)+1 > kps->maxlen) {
> > + if (strlen(val) > kps->maxlen) {
> > printk(KERN_ERR "%s: string doesn't fit in %u chars.\n",
> > - kp->name, kps->maxlen-1);
> > + kp->name, kps->maxlen);
> > return -ENOSPC;
> > }
> > strcpy(kps->string, val);
>
> Hi,
> I believe that the code is correct. kps->maxlen is the lenght of the
> buffer; when dealing with a string of N chars you need an array of (N +
> 1) bytes in order to store the terminator ('\0').
>
> Look again at the check:
>
> if (strlen(val) > kps->maxlen) {
>
> Suppose that val is a string of 10 chars (strlen(val) == 10), suppose
> that the buffer holds 10 bytes (kps->maxlen == 10). The expression:
>
> if (10 > 10) {
>
> is false, so strcpy() ends up writing 11 bytes in a buffer of 10 bytes.
>
> Also, for future patches see point 11 of
> Documentation/SubmittingPatches.
>
> Luca
> --
> Home: http://kronoz.cjb.net
> "Su cio` di cui non si puo` parlare e` bene tacere".
> Ludwig Wittgenstein
>

2006-08-21 08:39:54

by Jan Engelhardt

[permalink] [raw]
Subject: Re: [PATCH] 2.6.17.9 Incorrect string length checking in param_set_copystring()

>> As for 2.6.17.9, linux/include/linux/moduleparam.h suggests the user
>> of module_param_string() to set the maxlen parameter to
>> strlen(string), ie. '\0' excluded.
>
> Actually, sizeof(string), not strlen(string). Senseless typo here.
> Sorry, my bad. :)

With \0 excluded, you want strlen(string) or sizeof(string)-1.


Jan Engelhardt
--