Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230802-wifi-ipw2x00-refactor-v1-1-6047659410d4@google.com> <86B2408D-BB52-4B29-BE4A-A6A12A129121@kernel.org>
In-Reply-To: <86B2408D-BB52-4B29-BE4A-A6A12A129121@kernel.org>
From:   Justin Stitt <justinstitt@google.com>
Date:   Tue, 1 Aug 2023 18:25:55 -0700
Message-ID: <CAFhGd8p9UUXoeA85UsCvB3B3+gF=vUcz+Z_s=hn95XCU8btCNQ@mail.gmail.com>
Subject: Re: [PATCH] wifi: ipw2x00: refactor to use kstrtoul
To:     Kees Cook <kees@kernel.org>
Cc:     Stanislav Yakovlev <stas.yakovlev@gmail.com>,
        Kalle Valo <kvalo@kernel.org>,
        Kees Cook <keescook@chromium.org>,
        linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-hardening@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Tue, Aug 1, 2023 at 6:16=E2=80=AFPM Kees Cook <kees@kernel.org> wrote:
>
> On August 1, 2023 5:51:59 PM PDT, Justin Stitt <justinstitt@google.com> w=
rote:
> >The current implementation seems to reinvent what `kstrtoul` already doe=
s
> >in terms of functionality and error handling. Remove uses of `simple_str=
toul()`
> >in favor of `kstrtoul()`.
> >
> >There is the following note at `lib/vsprintf.c:simple_strtoull()` which
> >further backs this change:
> >| * This function has caveats. Please use kstrtoull (or kstrtoul) instea=
d.
> >
> >And here, simple_str* are explicitly deprecated [3].
> >
> >This patch also removes an instance of the deprecated `strncpy` which he=
lps [2].
> >
> >Link: https://lore.kernel.org/all/202308011602.3CC1C0244C@keescook/ [1]
> >Link: https://github.com/KSPP/linux/issues/90 [2]
> >Link: https://docs.kernel.org/process/deprecated.html#simple-strtol-simp=
le-strtoll-simple-strtoul-simple-strtoull [3]
> >Cc: linux-hardening@vger.kernel.org
> >Suggested-by: Kees Cook <keescook@chromium.org>
> >Signed-off-by: Justin Stitt <justinstitt@google.com>
> >---
> >
> >
> >Link: https://lore.kernel.org/all/20230801-drivers-net-wireless-intel-ip=
w2x00-v1-1-ffd185c91292@google.com/
> >---
> > drivers/net/wireless/intel/ipw2x00/ipw2200.c | 43 +++++++++------------=
-------
> > 1 file changed, 14 insertions(+), 29 deletions(-)
> >
> >diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/=
wireless/intel/ipw2x00/ipw2200.c
> >index dfe0f74369e6..ac10633f593e 100644
> >--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
> >+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
> >@@ -1176,23 +1176,20 @@ static ssize_t debug_level_show(struct device_dr=
iver *d, char *buf)
> > static ssize_t debug_level_store(struct device_driver *d, const char *b=
uf,
> >                                size_t count)
> > {
> >-      char *p =3D (char *)buf;
> >-      u32 val;
> >+      unsigned long *val =3D NULL;
> >
> >-      if (p[1] =3D=3D 'x' || p[1] =3D=3D 'X' || p[0] =3D=3D 'x' || p[0]=
 =3D=3D 'X') {
> >-              p++;
> >-              if (p[0] =3D=3D 'x' || p[0] =3D=3D 'X')
> >-                      p++;
> >-              val =3D simple_strtoul(p, &p, 16);
> >-      } else
> >-              val =3D simple_strtoul(p, &p, 10);
> >-      if (p =3D=3D buf)
> >+      int result =3D kstrtoul(buf, 0, val);
>
> kstrtoul needs somewhere to write the value, so val need to be actually u=
nsigned long, and a pointer passed to that:
>
> unsigned long val;
> ...
> ... kstrtoul(but, 0, &val);
>
> But otherwise, yeah, this looks like the right direction to me.
>
> >+
> >+      if (result =3D=3D -EINVAL)
> >               printk(KERN_INFO DRV_NAME
> >                      ": %s is not in hex or decimal form.\n", buf);
> >+      else if (result =3D=3D -ERANGE)
> >+              printk(KERN_INFO DRV_NAME
> >+                       ": %s has overflowed.\n", buf);
> >       else
> >-              ipw_debug_level =3D val;
> >+              ipw_debug_level =3D *val;
> >
> >-      return strnlen(buf, count);
> >+      return count;.
>
> It might be worth mentioning this return value change, but I think it's c=
orrect: we're communicating how much was consumed (we consumed it all). Whe=
n the return value !=3D count, this function may be called again with the "=
rest" of the input. As this is a sysfs interface, that kind of behavior is =
very rare bordering on actively unwanted. :) So, I think these should eithe=
r return a negative error or count.
>
> -Kees
>
> > }
> > static DRIVER_ATTR_RW(debug_level);
> >
> >@@ -1461,33 +1458,21 @@ static ssize_t scan_age_store(struct device *d, =
struct device_attribute *attr,
> > {
> >       struct ipw_priv *priv =3D dev_get_drvdata(d);
> >       struct net_device *dev =3D priv->net_dev;
> >-      char buffer[] =3D "00000000";
> >-      unsigned long len =3D
> >-          (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1;
> >-      unsigned long val;
> >-      char *p =3D buffer;
> >
> >       IPW_DEBUG_INFO("enter\n");
> >
> >-      strncpy(buffer, buf, len);
> >-      buffer[len] =3D 0;
> >+      unsigned long *val =3D NULL;
> >+      int result =3D kstrtoul(buf, 0, val);
> >
> >-      if (p[1] =3D=3D 'x' || p[1] =3D=3D 'X' || p[0] =3D=3D 'x' || p[0]=
 =3D=3D 'X') {
> >-              p++;
> >-              if (p[0] =3D=3D 'x' || p[0] =3D=3D 'X')
> >-                      p++;
> >-              val =3D simple_strtoul(p, &p, 16);
> >-      } else
> >-              val =3D simple_strtoul(p, &p, 10);
> >-      if (p =3D=3D buffer) {
> >+      if (result =3D=3D -EINVAL || result =3D=3D -ERANGE) {
> >               IPW_DEBUG_INFO("%s: user supplied invalid value.\n", dev-=
>name);
> >       } else {
> >-              priv->ieee->scan_age =3D val;
> >+              priv->ieee->scan_age =3D *val;
> >               IPW_DEBUG_INFO("set scan_age =3D %u\n", priv->ieee->scan_=
age);
> >       }
> >
> >       IPW_DEBUG_INFO("exit\n");
> >-      return len;
> >+      return count;
> > }
> >
> > static DEVICE_ATTR_RW(scan_age);
> >
> >---
> >base-commit: 5d0c230f1de8c7515b6567d9afba1f196fb4e2f4
> >change-id: 20230801-wifi-ipw2x00-refactor-fa6deb6c67ea
> >
> >Best regards,
> >--
> >Justin Stitt <justinstitt@google.com>
> >
>
>
> --
> Kees Cook

Thanks for the feedback. v2 available here:
https://lore.kernel.org/all/20230802-wifi-ipw2x00-refactor-v2-1-d33f765e9cd=
5@google.com/