From patchwork Sun Jul 9 16:02:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiang W X-Patchwork-Id: 1805322 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=opensbi-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=Z26c3wXR; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=126.com header.i=@126.com header.a=rsa-sha256 header.s=s110527 header.b=bt54Xuot; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4QzX4z2JMBz20ZQ for ; Mon, 10 Jul 2023 02:04:19 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=9Jiak1ELaZbyuFqALKlODM/Q+dBwFhGJnKmgvBpjJ9I=; b=Z26c3wXRohEEYo OVA9CqPqM9O5zqoZDE6BV0zkfvxPlgL6gPRckcnR2BUpVo4UvNzgW8sOPOB4sPH09xfp7mj1M1jXx Zo8fkTDXuI01qClctPp7lGVOBW8MWoHerV2g3tZm9d+gwF9pzPzmuo8RG5KVaN1jlJxAK9xT9dohe WwdjsqKWpGMMQwiwxYTshmJuwbgYib6Fca70IkiZrF66aI/qi6UMQT814hIAYZZPmpoFDHQ0xmrLf ocLG3oOellrUGpx0WwiwS+f/tSBtSRNL0BcpNqGbAT4rE8XjTGA5XLKciFEFfmzdIY3b5G8VcZ9Ia dZGGf/43Yj86lYuHrAxQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qIWtE-009O9c-0P; Sun, 09 Jul 2023 16:04:00 +0000 Received: from m126.mail.126.com ([220.181.12.26]) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qIWt6-009O6v-2q for opensbi@lists.infradead.org; Sun, 09 Jul 2023 16:03:58 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=Apua0 fsE9Y/VfNwUngml5sZ9RHLdUkMrQqqjUHARl9s=; b=bt54Xuot4ZP/rXON5ce4s SJ8ofZEdg0eM692w2Nw640//npVS6p9yYYRJURYeJgoDVbsLTMAOR8i7krDT1Fi7 eIIKFi4TytU6orj/wtX6sIFk2/NIpMr4WpRutbkRNGEJgZkb6r3ajZn87LsPmhRC ETirKjuuAHAUSi8M8k8Owg= Received: from x390.lan (unknown [58.247.180.222]) by zwqz-smtp-mta-g3-0 (Coremail) with SMTP id _____wAHZ88g2qpkXwBNAg--.15048S12; Mon, 10 Jul 2023 00:02:45 +0800 (CST) From: Xiang W To: opensbi@lists.infradead.org Cc: Xiang W , anup@brainfault.org, jrtc27@jrtc27.com Subject: [PATCH v9 10/11] lib: sbi: Fix timing of clearing tbuf Date: Mon, 10 Jul 2023 00:02:30 +0800 Message-Id: <20230709160231.202121-11-wxjstz@126.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230709160231.202121-1-wxjstz@126.com> References: <20230709160231.202121-1-wxjstz@126.com> MIME-Version: 1.0 X-CM-TRANSID: _____wAHZ88g2qpkXwBNAg--.15048S12 X-Coremail-Antispam: 1Uf129KBjvJXoWxXFWktr4DKFy8CFy7JFyftFb_yoW5CFyxpa 1SyasxXw4Fva4kJrZ7Aa1DWF4Yy34rCF42krsrXFy8ZFZ8Z3ykJrWfJF15tF1DCayUArW5 C3Z5Xa4UGw4jqaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zRbdbbUUUUU= X-Originating-IP: [58.247.180.222] X-CM-SenderInfo: pz0m23b26rjloofrz/1tbi1wanOl53bmhRvQABsO X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230709_090353_263218_4B18A5F1 X-CRM114-Status: GOOD ( 10.62 ) X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: A single scan of the format char may add multiple characters to the tbuf, causing a buffer overflow. You should check if tbuf is full in printc so that it does not cause a buffer overflow. Signed-off-by: Xiang W Reviewed-by: Anup Patel --- lib/sbi/sbi_console.c | 35 +++++++++++++++++++ 1 file changed, 19 insertions(+), 16 deletions(-) Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [wxjstz[at]126.com] -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-BeenThere: opensbi@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "opensbi" Errors-To: opensbi-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org A single scan of the format char may add multiple characters to the tbuf, causing a buffer overflow. You should check if tbuf is full in printc so that it does not cause a buffer overflow. Signed-off-by: Xiang W Reviewed-by: Anup Patel --- lib/sbi/sbi_console.c | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/lib/sbi/sbi_console.c b/lib/sbi/sbi_console.c index af5e94b..00feec8 100644 --- a/lib/sbi/sbi_console.c +++ b/lib/sbi/sbi_console.c @@ -121,6 +121,7 @@ unsigned long sbi_ngets(char *str, unsigned long len) #define PAD_ZERO 2 #define PAD_ALTERNATE 4 #define PAD_SIGN 8 +#define USE_TBUF 16 #define PRINT_BUF_LEN 64 #define va_start(v, l) __builtin_va_start((v), l) @@ -128,7 +129,7 @@ unsigned long sbi_ngets(char *str, unsigned long len) #define va_arg __builtin_va_arg typedef __builtin_va_list va_list; -static void printc(char **out, u32 *out_len, char ch) +static void printc(char **out, u32 *out_len, char ch, int flags) { if (!out) { sbi_putc(ch); @@ -142,8 +143,14 @@ static void printc(char **out, u32 *out_len, char ch) if (!out_len || *out_len > 1) { *(*out)++ = ch; **out = '\0'; - if (out_len) + if (out_len) { --(*out_len); + if ((flags & USE_TBUF) && *out_len == 1) { + nputs_all(console_tbuf, CONSOLE_TBUF_MAX - *out_len); + *out = console_tbuf; + *out_len = CONSOLE_TBUF_MAX; + } + } } } @@ -154,16 +161,16 @@ static int prints(char **out, u32 *out_len, const char *string, int width, width -= sbi_strlen(string); if (!(flags & PAD_RIGHT)) { for (; width > 0; --width) { - printc(out, out_len, flags & PAD_ZERO ? '0' : ' '); + printc(out, out_len, flags & PAD_ZERO ? '0' : ' ', flags); ++pc; } } for (; *string; ++string) { - printc(out, out_len, *string); + printc(out, out_len, *string, flags); ++pc; } for (; width > 0; --width) { - printc(out, out_len, ' '); + printc(out, out_len, ' ', flags); ++pc; } @@ -215,18 +222,18 @@ static int printi(char **out, u32 *out_len, long long i, if (flags & PAD_ZERO) { if (sign) { - printc(out, out_len, sign); + printc(out, out_len, sign, flags); ++pc; --width; } if (i && (flags & PAD_ALTERNATE)) { if (b == 16 || b == 8) { - printc(out, out_len, '0'); + printc(out, out_len, '0', flags); ++pc; --width; } if (b == 16) { - printc(out, out_len, 'x' - 'a' + letbase); + printc(out, out_len, 'x' - 'a' + letbase, flags); ++pc; --width; } @@ -265,15 +272,11 @@ static int print(char **out, u32 *out_len, const char *format, va_list args) } for (; *format != 0; ++format) { - if (use_tbuf && !console_tbuf_len) { - nputs_all(console_tbuf, CONSOLE_TBUF_MAX); - console_tbuf_len = CONSOLE_TBUF_MAX; - tout = console_tbuf; - } - + width = flags = 0; + if (use_tbuf) + flags |= USE_TBUF; if (*format == '%') { ++format; - width = flags = 0; if (*format == '\0') break; if (*format == '%') @@ -371,7 +374,7 @@ static int print(char **out, u32 *out_len, const char *format, va_list args) } } else { literal: - printc(out, out_len, *format); + printc(out, out_len, *format, flags); ++pc; } }