Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Subject: Re: [PATCH 2/4] ACPI: battery: Fix buffer overread if not
 NUL-terminated
To:     "Rafael J. Wysocki" <rafael@kernel.org>
Cc:     lenb@kernel.org, linux-acpi@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20230114085053.72059-1-W_Armin@gmx.de>
 <20230114085053.72059-3-W_Armin@gmx.de>
 <CAJZ5v0h2vTAUovMoEoWVX2gJQiJS6C9PSYzMqQMtxPusgdHBMQ@mail.gmail.com>
From:   Armin Wolf <W_Armin@gmx.de>
Message-ID: <90f1270d-3c37-088b-98ac-a08caba685e8@gmx.de>
Date:   Tue, 17 Jan 2023 22:01:17 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.13.0
MIME-Version: 1.0
In-Reply-To: <CAJZ5v0h2vTAUovMoEoWVX2gJQiJS6C9PSYzMqQMtxPusgdHBMQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
UI-OutboundReport: notjunk:1;M01:P0:MSvNwI6J0lQ=;Vs7jRF3ENCqJUnOM82hzUBHNH/S
 XHb5AQg1iDZXS5O9Xi5VurF+5p8MiO5trHIXOJLBdVZ/QAFh1WTug3e07QaKFlVvx6tqXZpiJ
 iVHalJ6E2O8oUFmDa2F2I/Pn9V7bxzA4vEVh9LY9cquF9E/n7DSJS2l8ioeL6VIc17SckISlv
 UgsO5BgADeBuM/JDRPkVb5+ESdPhAjtlbqwWFf4KxlwQrt0yb7iCWyUvpjb6mzTiU9Zcvovim
 1SPjPVigNVmYn5R+EqNorhw1WgvRROkipHYqd4CrH7cqZ0sqlbS6v4tIQOzlruydBZ7wra7Ee
 RI4Xw5JoIrDCz2Tb9rgezzl5vCAhIzBamY5rwswf25dJF83aywQC6mBBGtF55W4ODVHG2nj5r
 +u5+41UoWvQeyNqS+E5nbRXylQQMopo19CZFN6Dq4c006TIUGYVq+jqamxukc0vgDOG663jfZ
 Wiub8d3/EGHbC2XQ0PkK7mFMhW3cXQ8Blt0lbkFYS8EXK++eQo7m1/wY/ING3LaInpQzg2VbJ
 HNQO7RcIGl2mvKM1kPRhc0vPITSr8ARsvPINBMEPUph0DLz3DbYAMf1XToPf2WxG50+3NY9lp
 dzh/LB+zSr5Zn9TmNmp85y+u6wEgr6qCo08/vZmwk6PRawOjBCoDCmH+X0DLF2rHSNCtK+6dc
 17qbDxsMuxOyGVNpvjLixLXkkij9yQnAB3Y2gfo9qKKz3nStQOzEhVG698RLF0Ja54eVdfKM9
 8b6zaowhVnw+/s9CG0tlLfQAktHpJMLdis3u27ji8N6UexTguUEOEuEZi4Bwf8GXZXgdRVd7V
 2L7sWmIQS/1fKL22K2IISTqL7t03cxVHH+KSKG92r6o4ouqOYAUepUZzFZz9ZUs6YmYnDEaP6
 KGTAjN/qxtE0HPf2nreK0ny7Lov1Q/6dDF7T4xdMNGaZ9dYoBw/t26fK6UwNnhVj0xTQloVbF
 JsgI+Fa4IgFX/bmiqLSPQC1knew=
Precedence: bulk

Am 17.01.23 um 15:42 schrieb Rafael J. Wysocki:

> On Sat, Jan 14, 2023 at 9:51 AM Armin Wolf <W_Armin@gmx.de> wrote:
>> If the buffer containing string data is not NUL-terminated
>> (which is perfectly legal according to the ACPI specification),
>> the acpi battery driver might not honor its length.
> Note that this is about extracting package entries of type ACPI_TYPE_BUFFER.
>
> And please spell ACPI in capitals.
>
>> Fix this by limiting the amount of data to be copied to
>> the buffer length while also using strscpy() to make sure
>> that the resulting string is always NUL-terminated.
> OK
>
>> Also use '\0' instead of a plain 0.
> Why?  It's a u8, not a char.
>
>> Signed-off-by: Armin Wolf <W_Armin@gmx.de>
>> ---
>>   drivers/acpi/battery.c | 23 ++++++++++++++++-------
>>   1 file changed, 16 insertions(+), 7 deletions(-)
>>
>> diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
>> index fb64bd217d82..9f6daa9f2010 100644
>> --- a/drivers/acpi/battery.c
>> +++ b/drivers/acpi/battery.c
>> @@ -438,15 +438,24 @@ static int extract_package(struct acpi_battery *battery,
>>                  if (offsets[i].mode) {
>>                          u8 *ptr = (u8 *)battery + offsets[i].offset;
> I would add
>
> u32 len = 32;
>
>> -                       if (element->type == ACPI_TYPE_STRING ||
>> -                           element->type == ACPI_TYPE_BUFFER)
>> +                       switch (element->type) {
> And here I would do
>
> case ACPI_TYPE_BUFFER:
>          if (len > element->buffer.length + 1)
>                  len = element->buffer.length + 1;
>
>          fallthrough;
> case ACPI_TYPE_STRING:
>          strscpy(ptr, element->buffer.pointer, len);
>          break;
> case ACPI_TYPE_INTEGER:
>
> and so on.

But wouldn't this cause the ACPI string object to be accessed the wrong way
(buffer.pointer instead of string.pointer)?

Armin Wolf

>> +                       case ACPI_TYPE_STRING:
>>                                  strscpy(ptr, element->string.pointer, 32);
>> -                       else if (element->type == ACPI_TYPE_INTEGER) {
>> -                               strncpy(ptr, (u8 *)&element->integer.value,
>> -                                       sizeof(u64));
>> +
>> +                               break;
>> +                       case ACPI_TYPE_BUFFER:
>> +                               strscpy(ptr, element->buffer.pointer,
>> +                                       min_t(u32, element->buffer.length + 1, 32));
>> +
>> +                               break;
>> +                       case ACPI_TYPE_INTEGER:
>> +                               strncpy(ptr, (u8 *)&element->integer.value, sizeof(u64));
>>                                  ptr[sizeof(u64)] = 0;
>> -                       } else
>> -                               *ptr = 0; /* don't have value */
>> +
>> +                               break;
>> +                       default:
>> +                               *ptr = '\0'; /* don't have value */
>> +                       }
>>                  } else {
>>                          int *x = (int *)((u8 *)battery + offsets[i].offset);
>>                          *x = (element->type == ACPI_TYPE_INTEGER) ?
>> --