2017-12-13 11:13:39

by Juan Zea

Subject: [PATCH] usbip: fix usbip bind writing random string after command in match_busid

usbip bind writes commands followed by random string when writing to
match_busid attribute in sysfs, caused by using full variable size
instead of string length.

Signed-off-by: Juan Zea <[email protected]>
---
tools/usb/usbip/src/utils.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c
index 2b3d6d2..ea1a1af 100644
--- a/tools/usb/usbip/src/utils.c
+++ b/tools/usb/usbip/src/utils.c
@@ -42,7 +42,7 @@ int modify_match_busid(char *busid, int add)
snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid);

rc = write_sysfs_attribute(match_busid_attr_path, command,
- sizeof(command));
+ strlen(command));
if (rc < 0) {
dbg("failed to write match_busid: %s", strerror(errno));
return -1;
--
2.7.4

2017-12-13 17:42:56

by Shuah Khan

Subject: Re: [PATCH] usbip: fix usbip bind writing random string after command in match_busid

On 12/13/2017 04:07 AM, Juan Zea wrote:
> usbip bind writes commands followed by random string when writing to
> match_busid attribute in sysfs, caused by using full variable size
> instead of string length.
>
> Signed-off-by: Juan Zea <[email protected]>
> ---
> tools/usb/usbip/src/utils.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c
> index 2b3d6d2..ea1a1af 100644
> --- a/tools/usb/usbip/src/utils.c
> +++ b/tools/usb/usbip/src/utils.c
> @@ -42,7 +42,7 @@ int modify_match_busid(char *busid, int add)
> snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid);
>
> rc = write_sysfs_attribute(match_busid_attr_path, command,
> - sizeof(command));
> + strlen(command));
> if (rc < 0) {
> dbg("failed to write match_busid: %s", strerror(errno));
> return -1;
>

Why not use the return value from snprintf() for length, instead of calling
strlen(command)?

thanks,
-- Shuah

2017-12-14 10:23:50

by Juan Zea

Subject: Re: [PATCH] usbip: fix usbip bind writing random string after command in match_busid

> Why not use the return value from snprintf() for length, instead of calling
strlen(command)?

Yes, that makes sense. Something like this?

diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c
index 2b3d6d2..3d7b42e 100644
--- a/tools/usb/usbip/src/utils.c
+++ b/tools/usb/usbip/src/utils.c
@@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add)
char command[SYSFS_BUS_ID_SIZE + 4];
char match_busid_attr_path[SYSFS_PATH_MAX];
int rc;
+ int cmd_size;

snprintf(match_busid_attr_path, sizeof(match_busid_attr_path),
"%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME,
@@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add)
attr_name);

if (add)
- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid);
+ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s",
+ busid);
else
- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid);
+ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s",
+ busid);

rc = write_sysfs_attribute(match_busid_attr_path, command,
- sizeof(command));
+ cmd_size);
if (rc < 0) {
dbg("failed to write match_busid: %s", strerror(errno));
return -1;


Regards,
Juan

2017-12-14 20:14:30

by Shuah Khan

Subject: Re: [PATCH] usbip: fix usbip bind writing random string after command in match_busid

On 12/14/2017 03:23 AM, Juan Zea wrote:
>> Why not use the return value from snprintf() for length, instead of calling
> strlen(command)?
>
> Yes, that makes sense. Something like this?

Yes

>
> diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c
> index 2b3d6d2..3d7b42e 100644
> --- a/tools/usb/usbip/src/utils.c
> +++ b/tools/usb/usbip/src/utils.c
> @@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add)
> char command[SYSFS_BUS_ID_SIZE + 4];
> char match_busid_attr_path[SYSFS_PATH_MAX];
> int rc;
> + int cmd_size;
>
> snprintf(match_busid_attr_path, sizeof(match_busid_attr_path),
> "%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME,
> @@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add)
> attr_name);
>
> if (add)
> - snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid);
> + cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s",
> + busid);
> else
> - snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid);
> + cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s",
> + busid);
>
> rc = write_sysfs_attribute(match_busid_attr_path, command,
> - sizeof(command));
> + cmd_size);
> if (rc < 0) {
> dbg("failed to write match_busid: %s", strerror(errno));
> return -1;
>
>
> Regards,
> Juan
>

thanks,
-- Shuah

2017-12-15 09:21:34

by Juan Zea

Subject: [PATCH] usbip: fix usbip bind writing random string after command in match_busid

usbip bind writes commands followed by random string when writing to
match_busid attribute in sysfs, caused by using full variable size
instead of string length.

Signed-off-by: Juan Zea <[email protected]>
---
tools/usb/usbip/src/utils.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c
index 2b3d6d2..3d7b42e 100644
--- a/tools/usb/usbip/src/utils.c
+++ b/tools/usb/usbip/src/utils.c
@@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add)
char command[SYSFS_BUS_ID_SIZE + 4];
char match_busid_attr_path[SYSFS_PATH_MAX];
int rc;
+ int cmd_size;

snprintf(match_busid_attr_path, sizeof(match_busid_attr_path),
"%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME,
@@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add)
attr_name);

if (add)
- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid);
+ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s",
+ busid);
else
- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid);
+ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s",
+ busid);

rc = write_sysfs_attribute(match_busid_attr_path, command,
- sizeof(command));
+ cmd_size);
if (rc < 0) {
dbg("failed to write match_busid: %s", strerror(errno));
return -1;
--
2.7.4

2017-12-15 17:39:51

by Shuah Khan

Subject: Re: [PATCH] usbip: fix usbip bind writing random string after command in match_busid

On 12/15/2017 02:21 AM, Juan Zea wrote:
> usbip bind writes commands followed by random string when writing to
> match_busid attribute in sysfs, caused by using full variable size
> instead of string length.
>
> Signed-off-by: Juan Zea <[email protected]>
> ---
> tools/usb/usbip/src/utils.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c
> index 2b3d6d2..3d7b42e 100644
> --- a/tools/usb/usbip/src/utils.c
> +++ b/tools/usb/usbip/src/utils.c
> @@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add)
> char command[SYSFS_BUS_ID_SIZE + 4];
> char match_busid_attr_path[SYSFS_PATH_MAX];
> int rc;
> + int cmd_size;
>
> snprintf(match_busid_attr_path, sizeof(match_busid_attr_path),
> "%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME,
> @@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add)
> attr_name);
>
> if (add)
> - snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid);
> + cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s",
> + busid);
> else
> - snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid);
> + cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s",
> + busid);
>
> rc = write_sysfs_attribute(match_busid_attr_path, command,
> - sizeof(command));
> + cmd_size);
> if (rc < 0) {
> dbg("failed to write match_busid: %s", strerror(errno));
> return -1;
>

Thanks for the patch.

Greg, could you please pick this up.

Acked-by: Shuah Khan <[email protected]>

-- Shuah