Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 11 Feb 2021 19:39:18 -0800
From:   Drew Fustini <drew@beagleboard.org>
To:     Andy Shevchenko <andy.shevchenko@gmail.com>
Cc:     Geert Uytterhoeven <geert@linux-m68k.org>,
        Linus Walleij <linus.walleij@linaro.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Tony Lindgren <tony@atomide.com>,
        Alexandre Belloni <alexandre.belloni@bootlin.com>,
        Pantelis Antoniou <pantelis.antoniou@konsulko.com>,
        Jason Kridner <jkridner@beagleboard.org>,
        Robert Nelson <robertcnelson@beagleboard.org>,
        Joe Perches <joe@perches.com>,
        Dan Carpenter <dan.carpenter@oracle.com>
Subject: Re: [PATCH v4 2/2] pinctrl: pinmux: Add pinmux-select debugfs file
Message-ID: <20210212033918.GC347396@x1>
References: <20210210222851.232374-1-drew@beagleboard.org>
 <20210210222851.232374-3-drew@beagleboard.org>
 <CAMuHMdW3dZWEbHzXZ-62S-bb3WKbrfwR_EKf7b_fQ6z913SX1A@mail.gmail.com>
 <CAHp75VeBbv8YzsnOsdXKOwPFd2WpjueCwMgm9mQPR2Xq4zW3QQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAHp75VeBbv8YzsnOsdXKOwPFd2WpjueCwMgm9mQPR2Xq4zW3QQ@mail.gmail.com>
Precedence: bulk

On Thu, Feb 11, 2021 at 11:53:24AM +0200, Andy Shevchenko wrote:
> On Thu, Feb 11, 2021 at 10:09 AM Geert Uytterhoeven
> <geert@linux-m68k.org> wrote:
> > On Wed, Feb 10, 2021 at 11:33 PM Drew Fustini <drew@beagleboard.org> wrote:
> 
> 
> > > +#define PINMUX_MAX_NAME 64
> 
> > > +       if (len > (PINMUX_MAX_NAME * 2)) {
> > > +               dev_err(pctldev->dev, "write too big for buffer");
> > > +               return -EINVAL;
> > > +       }
> > > +
> > > +       buf = kzalloc(PINMUX_MAX_NAME * 2, GFP_KERNEL);
> 
> > > +       ret = strncpy_from_user(buf, user_buf, PINMUX_MAX_NAME * 2);
> >
> > While this guarantees buf is not overflowed...
> >
> > > +       if (ret < 0) {
> > > +               dev_err(pctldev->dev, "failed to copy buffer from userspace");
> > > +               goto free_gname;
> > > +       }
> > > +       buf[len-1] = '\0';
> > > +
> > > +       ret = sscanf(buf, "%s %s", fname, gname);
> >
> > ... one of the two strings can still be longer than PINMUX_MAX_NAME,
> > thus overflowing fname or gname.
> >
> > As buf is already a copy, it may be easier to just find the strings in
> > buf, write the NUL terminators into buf, and set up fname and gname
> > to point to the strings inside buf.
> 
> You beat me up to it. I was about to comment the same.
> 
> So, indeed, instead of sscanf it's simply better and faster to do just
> something like
> 
> fname = strstrip(buf) ;
> if (*fname == '\0') {
>   ...
>   return -EINVAL;
> }
> 
> gname = strchr(fname, ' ');
> if (!gname) {
>  ...
>   return -EINVAL;
> }
> *gname++ = '\0';
> 
> on top of the buf pointer.
> 

Thank you for the suggestion about how to implement this.  I'll use that
in the next revision.

-Drew