On Thu, Sep 15, 2022 at 02:34:25PM -0700, Andrew Morton wrote:
> libfs-fix-error-format-in-simple_attr_write.patch
> From: Eliav Farber <[email protected]>
> Subject: libfs: fix error format in simple_attr_write()
> Date: Thu, 15 Sep 2022 09:15:44 +0000
>
> In commit 488dac0c9237 ("libfs: fix error cast of negative value in
> simple_attr_write()"), simple_attr_write() was changed to use kstrtoull()
> instead of simple_strtoll() to convert a string got from a user. A user
> trying to set a negative value will get an error.
>
> This is wrong since it breaks all the places that use
> DEFINE_DEBUGFS_ATTRIBUTE() with format of a signed integer.
>
> For the record there are 43 current users of signed integer which are
> likely to be effected by this:
>
> $ git grep -n -A1 -w DEFINE_DEBUGFS_ATTRIBUTE | grep ');' |
> sed 's,.*\(".*%.*"\).*,\1,' | sort | uniq -c
> 1 "%08llx\n"
> 5 "0x%016llx\n"
> 5 "0x%02llx\n"
> 5 "0x%04llx\n"
> 13 "0x%08llx\n"
> 1 "0x%4.4llx\n"
> 3 "0x%.4llx\n"
> 4 "0x%llx\n"
> 1 "%1lld\n"
> 40 "%lld\n"
> 2 "%lli\n"
> 129 "%llu\n"
> 1 "%#llx\n"
> 2 "%llx\n"
>
> u64 is not an issue for negative numbers.
> The %lld and %llu in any case are for 64-bit value, representing it as
> unsigned simplifies the generic code, but it doesn't mean we can't keep
> their signed value if we know that.
>
> This change uses sscanf() to fix the problem since it does the conversion
> based on the supplied format string.
> --- a/fs/libfs.c~libfs-fix-error-format-in-simple_attr_write
> +++ a/fs/libfs.c
> @@ -1017,9 +1017,12 @@ ssize_t simple_attr_write(struct file *f
> goto out;
>
> attr->set_buf[size] = '\0';
> - ret = kstrtoull(attr->set_buf, 0, &val);
> - if (ret)
> + ret = sscanf(attr->set_buf, attr->fmt, &val);
> + if (ret != 1) {
> + ret = -EINVAL;
> goto out;
> + }
> +
> ret = attr->set(attr->data, val);
> if (ret == 0)
> ret = len; /* on success, claim we got the whole input */
No scanf please. Just revert original patch if something broke.
scanf may be tolerable if it is just one format conversion but it is
disaster as an interface.
On 9/16/2022 9:11 AM, Alexey Dobriyan wrote:
> On Thu, Sep 15, 2022 at 02:34:25PM -0700, Andrew Morton wrote:
>> libfs-fix-error-format-in-simple_attr_write.patch
>
>> From: Eliav Farber <[email protected]>
>> Subject: libfs: fix error format in simple_attr_write()
>> Date: Thu, 15 Sep 2022 09:15:44 +0000
>>
>> In commit 488dac0c9237 ("libfs: fix error cast of negative value in
>> simple_attr_write()"), simple_attr_write() was changed to use
>> kstrtoull()
>> instead of simple_strtoll() to convert a string got from a user. A user
>> trying to set a negative value will get an error.
>>
>> This is wrong since it breaks all the places that use
>> DEFINE_DEBUGFS_ATTRIBUTE() with format of a signed integer.
>>
>> For the record there are 43 current users of signed integer which are
>> likely to be effected by this:
>>
>> $ git grep -n -A1 -w DEFINE_DEBUGFS_ATTRIBUTE | grep ');' |
>> sed 's,.*\(".*%.*"\).*,\1,' | sort | uniq -c
>> 1 "%08llx\n"
>> 5 "0x%016llx\n"
>> 5 "0x%02llx\n"
>> 5 "0x%04llx\n"
>> 13 "0x%08llx\n"
>> 1 "0x%4.4llx\n"
>> 3 "0x%.4llx\n"
>> 4 "0x%llx\n"
>> 1 "%1lld\n"
>> 40 "%lld\n"
>> 2 "%lli\n"
>> 129 "%llu\n"
>> 1 "%#llx\n"
>> 2 "%llx\n"
>>
>> u64 is not an issue for negative numbers.
>> The %lld and %llu in any case are for 64-bit value, representing it as
>> unsigned simplifies the generic code, but it doesn't mean we can't keep
>> their signed value if we know that.
>>
>> This change uses sscanf() to fix the problem since it does the
>> conversion
>> based on the supplied format string.
>
>> --- a/fs/libfs.c~libfs-fix-error-format-in-simple_attr_write
>> +++ a/fs/libfs.c
>> @@ -1017,9 +1017,12 @@ ssize_t simple_attr_write(struct file *f
>> goto out;
>>
>> attr->set_buf[size] = '\0';
>> - ret = kstrtoull(attr->set_buf, 0, &val);
>> - if (ret)
>> + ret = sscanf(attr->set_buf, attr->fmt, &val);
>> + if (ret != 1) {
>> + ret = -EINVAL;
>> goto out;
>> + }
>> +
>> ret = attr->set(attr->data, val);
>> if (ret == 0)
>> ret = len; /* on success, claim we got the whole input */
>
> No scanf please. Just revert original patch if something broke.
>
> scanf may be tolerable if it is just one format conversion but it is
> disaster as an interface.
If I revert original patch I get this checkpatch warning:
"WARNING: simple_strtoll is obsolete, use kstrtoll instead".
Should I still revert the original patch as is, or send a new patch that
fixes the issue by using kstrtoll()?
--
Thanks, Eliav
On Fri, 16 Sep 2022 14:19:29 +0300 "Farber, Eliav" <[email protected]> wrote:
> Should I still revert the original patch as is, or send a new patch that
> fixes the issue by using kstrtoll()?
That sounds better.