From patchwork Wed Jul 5 14:37:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiang W X-Patchwork-Id: 1803770 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=opensbi-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=sl1C9hAl; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=126.com header.i=@126.com header.a=rsa-sha256 header.s=s110527 header.b=Dzcztm7l; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Qx2Pj3XKvz20Pf for ; Thu, 6 Jul 2023 00:40:09 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=BGvbVO2+NQ0XrTjwq3LshEb9mE6nJeQ8ooAF1pizwbU=; b=sl1C9hAl2/PsZ8 7ICYrqVfKFRLjd52kMRxSGp2OUk6b/qxDmHM0HOeIqbSjhONzdWajc0lQUlpiB/N4WqGfbV+DdyDO cokTwWrAoI4eYMRR44ce+lB7cj1rGwStYw64F88TJseANYRg3Hr2STECU7AbUcSgV2bAnqdfncXvd yf+NG5BQ1n2jZMuJagueeG8OL1DA3lbHDPxxaQdsbAerOrJuefJRyYg1C1ZmTdFijLcPiqkA3reys N26vXARdaCkqLFlgYhwTmviSlCqAIsnUf0STFN0TP6NaWG7FymfY4vrLyZhNzwV9xkW8+PBSdzlQh QMwUOt7i6owq0EhDP4VQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qH3fe-00GANU-1I; Wed, 05 Jul 2023 14:39:54 +0000 Received: from m126.mail.126.com ([220.181.12.36]) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qH3fb-00GAKK-0A for opensbi@lists.infradead.org; Wed, 05 Jul 2023 14:39:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=hXBpx nf2G263fpf7LRtUis3OVUGx+9oMKpsCOjWwfko=; b=Dzcztm7lGQixTfpXneyzq hH3q3GGrAORBJ9yWPghD6tgsDot24xlW3mugCgms9jXIVCrdlyi973I/QUe5pTXT Aey22WZet44Nph4KtP7tKBfMKYXQ4zGYVh8hdcWpKvRoOz0HRORgZ5YXbh5dgEtg R3RDDtmfpJK9ERIXBA6SD8= Received: from x390.lan (unknown [58.247.180.222]) by zwqz-smtp-mta-g5-0 (Coremail) with SMTP id _____wBHT_8SgKVklkTIAQ--.24282S12; Wed, 05 Jul 2023 22:37:10 +0800 (CST) From: Xiang W To: opensbi@lists.infradead.org Cc: Xiang W , anup@brainfault.org, jrtc27@jrtc27.com Subject: [PATCH v8 10/11] lib: sbi: Fix timing of clearing tbuf Date: Wed, 5 Jul 2023 22:37:02 +0800 Message-Id: <20230705143703.635254-11-wxjstz@126.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230705143703.635254-1-wxjstz@126.com> References: <20230705143703.635254-1-wxjstz@126.com> MIME-Version: 1.0 X-CM-TRANSID: _____wBHT_8SgKVklkTIAQ--.24282S12 X-Coremail-Antispam: 1Uf129KBjvJXoWxXFWktr4DKFy8CFy7JFyftFb_yoW5CryrpF 4Sy3ZxXw4Fva4kJrWkAa1DWF4Yy34rCF42krsrXFy8Za98Z3ykJrWfJF15tF1DCayUArW5 C3Z5Xa4UGw4jgaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zRbdbbUUUUU= X-Originating-IP: [58.247.180.222] X-CM-SenderInfo: pz0m23b26rjloofrz/1tbiFxujOlpEGqTgbwAAs6 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230705_073951_899453_7FBE2976 X-CRM114-Status: GOOD ( 10.64 ) X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: A single scan of the format char may add multiple characters to the tbuf, causing a buffer overflow. You should check if tbuf is full in printc so that it does not cause a buffer overflow. Signed-off-by: Xiang W --- lib/sbi/sbi_console.c | 35 +++++++++++++++++++ 1 file changed, 19 insertions(+), 16 deletions(-) Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [wxjstz[at]126.com] -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-BeenThere: opensbi@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "opensbi" Errors-To: opensbi-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org A single scan of the format char may add multiple characters to the tbuf, causing a buffer overflow. You should check if tbuf is full in printc so that it does not cause a buffer overflow. Signed-off-by: Xiang W Reviewed-by: Anup Patel --- lib/sbi/sbi_console.c | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/lib/sbi/sbi_console.c b/lib/sbi/sbi_console.c index af5e94b..00feec8 100644 --- a/lib/sbi/sbi_console.c +++ b/lib/sbi/sbi_console.c @@ -121,6 +121,7 @@ unsigned long sbi_ngets(char *str, unsigned long len) #define PAD_ZERO 2 #define PAD_ALTERNATE 4 #define PAD_SIGN 8 +#define USE_TBUF 16 #define PRINT_BUF_LEN 64 #define va_start(v, l) __builtin_va_start((v), l) @@ -128,7 +129,7 @@ unsigned long sbi_ngets(char *str, unsigned long len) #define va_arg __builtin_va_arg typedef __builtin_va_list va_list; -static void printc(char **out, u32 *out_len, char ch) +static void printc(char **out, u32 *out_len, char ch, int flags) { if (!out) { sbi_putc(ch); @@ -142,8 +143,14 @@ static void printc(char **out, u32 *out_len, char ch) if (!out_len || *out_len > 1) { *(*out)++ = ch; **out = '\0'; - if (out_len) + if (out_len) { --(*out_len); + if ((flags & USE_TBUF) && *out_len == 1) { + nputs_all(console_tbuf, CONSOLE_TBUF_MAX - *out_len); + *out = console_tbuf; + *out_len = CONSOLE_TBUF_MAX; + } + } } } @@ -154,16 +161,16 @@ static int prints(char **out, u32 *out_len, const char *string, int width, width -= sbi_strlen(string); if (!(flags & PAD_RIGHT)) { for (; width > 0; --width) { - printc(out, out_len, flags & PAD_ZERO ? '0' : ' '); + printc(out, out_len, flags & PAD_ZERO ? '0' : ' ', flags); ++pc; } } for (; *string; ++string) { - printc(out, out_len, *string); + printc(out, out_len, *string, flags); ++pc; } for (; width > 0; --width) { - printc(out, out_len, ' '); + printc(out, out_len, ' ', flags); ++pc; } @@ -215,18 +222,18 @@ static int printi(char **out, u32 *out_len, long long i, if (flags & PAD_ZERO) { if (sign) { - printc(out, out_len, sign); + printc(out, out_len, sign, flags); ++pc; --width; } if (i && (flags & PAD_ALTERNATE)) { if (b == 16 || b == 8) { - printc(out, out_len, '0'); + printc(out, out_len, '0', flags); ++pc; --width; } if (b == 16) { - printc(out, out_len, 'x' - 'a' + letbase); + printc(out, out_len, 'x' - 'a' + letbase, flags); ++pc; --width; } @@ -265,15 +272,11 @@ static int print(char **out, u32 *out_len, const char *format, va_list args) } for (; *format != 0; ++format) { - if (use_tbuf && !console_tbuf_len) { - nputs_all(console_tbuf, CONSOLE_TBUF_MAX); - console_tbuf_len = CONSOLE_TBUF_MAX; - tout = console_tbuf; - } - + width = flags = 0; + if (use_tbuf) + flags |= USE_TBUF; if (*format == '%') { ++format; - width = flags = 0; if (*format == '\0') break; if (*format == '%') @@ -371,7 +374,7 @@ static int print(char **out, u32 *out_len, const char *format, va_list args) } } else { literal: - printc(out, out_len, *format); + printc(out, out_len, *format, flags); ++pc; } }