Skip to content

Commit

Permalink
mmc: core: use sysfs_emit() instead of sprintf()
Browse files Browse the repository at this point in the history 
commit f5d8a5f upstream.

sprintf() (still used in the MMC core for the sysfs output) is vulnerable
to the buffer overflow.  Use the new-fangled sysfs_emit() instead.

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.

Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/717729b2-d65b-c72e-9fac-471d28d00b5a@omp.ru
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
@gregkh
Sergey Shtylyov authored and gregkh committed Apr 8, 2022
1 parent 67f7bd9 commit c4ab657
Show file tree
Hide file tree
Showing 6 changed files with 34 additions and 31 deletions.
9 changes: 5 additions & 4 deletions drivers/mmc/core/bus.c
View file
Expand Up @@ -15,6 +15,7 @@
#include <linux/stat.h>
#include <linux/of.h>
#include <linux/pm_runtime.h>
#include <linux/sysfs.h>

#include <linux/mmc/card.h>
#include <linux/mmc/host.h>
Expand All @@ -34,13 +35,13 @@ static ssize_t type_show(struct device *dev,

switch (card->type) {
case MMC_TYPE_MMC:
return sprintf(buf, "MMC\n");
return sysfs_emit(buf, "MMC\n");
case MMC_TYPE_SD:
return sprintf(buf, "SD\n");
return sysfs_emit(buf, "SD\n");
case MMC_TYPE_SDIO:
return sprintf(buf, "SDIO\n");
return sysfs_emit(buf, "SDIO\n");
case MMC_TYPE_SD_COMBO:
return sprintf(buf, "SDcombo\n");
return sysfs_emit(buf, "SDcombo\n");
default:
return -EFAULT;
}
Expand Down
3 changes: 2 additions & 1 deletion drivers/mmc/core/bus.h
View file
Expand Up @@ -9,6 +9,7 @@
#define _MMC_CORE_BUS_H

#include <linux/device.h>
#include <linux/sysfs.h>

struct mmc_host;
struct mmc_card;
Expand All @@ -17,7 +18,7 @@ struct mmc_card;
static ssize_t mmc_##name##_show (struct device *dev, struct device_attribute *attr, char *buf) \
{ \
struct mmc_card *card = mmc_dev_to_card(dev); \
return sprintf(buf, fmt, args); \
return sysfs_emit(buf, fmt, args); \
} \
static DEVICE_ATTR(name, S_IRUGO, mmc_##name##_show, NULL)

Expand Down
16 changes: 8 additions & 8 deletions drivers/mmc/core/mmc.c
View file
Expand Up @@ -12,6 +12,7 @@
#include <linux/slab.h>
#include <linux/stat.h>
#include <linux/pm_runtime.h>
#include <linux/sysfs.h>

#include <linux/mmc/host.h>
#include <linux/mmc/card.h>
Expand Down Expand Up @@ -812,12 +813,11 @@ static ssize_t mmc_fwrev_show(struct device *dev,
{
struct mmc_card *card = mmc_dev_to_card(dev);

if (card->ext_csd.rev < 7) {
return sprintf(buf, "0x%x\n", card->cid.fwrev);
} else {
return sprintf(buf, "0x%*phN\n", MMC_FIRMWARE_LEN,
card->ext_csd.fwrev);
}
if (card->ext_csd.rev < 7)
return sysfs_emit(buf, "0x%x\n", card->cid.fwrev);
else
return sysfs_emit(buf, "0x%*phN\n", MMC_FIRMWARE_LEN,
card->ext_csd.fwrev);
}

static DEVICE_ATTR(fwrev, S_IRUGO, mmc_fwrev_show, NULL);
Expand All @@ -830,10 +830,10 @@ static ssize_t mmc_dsr_show(struct device *dev,
struct mmc_host *host = card->host;

if (card->csd.dsr_imp && host->dsr_req)
return sprintf(buf, "0x%x\n", host->dsr);
return sysfs_emit(buf, "0x%x\n", host->dsr);
else
/* return default DSR value */
return sprintf(buf, "0x%x\n", 0x404);
return sysfs_emit(buf, "0x%x\n", 0x404);
}

static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL);
Expand Down
25 changes: 12 additions & 13 deletions drivers/mmc/core/sd.c
View file
Expand Up @@ -13,6 +13,7 @@
#include <linux/stat.h>
#include <linux/pm_runtime.h>
#include <linux/scatterlist.h>
#include <linux/sysfs.h>

#include <linux/mmc/host.h>
#include <linux/mmc/card.h>
Expand Down Expand Up @@ -708,18 +709,16 @@ MMC_DEV_ATTR(ocr, "0x%08x\n", card->ocr);
MMC_DEV_ATTR(rca, "0x%04x\n", card->rca);


static ssize_t mmc_dsr_show(struct device *dev,
struct device_attribute *attr,
char *buf)
static ssize_t mmc_dsr_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
struct mmc_card *card = mmc_dev_to_card(dev);
struct mmc_host *host = card->host;

if (card->csd.dsr_imp && host->dsr_req)
return sprintf(buf, "0x%x\n", host->dsr);
else
/* return default DSR value */
return sprintf(buf, "0x%x\n", 0x404);
struct mmc_card *card = mmc_dev_to_card(dev);
struct mmc_host *host = card->host;

if (card->csd.dsr_imp && host->dsr_req)
return sysfs_emit(buf, "0x%x\n", host->dsr);
/* return default DSR value */
return sysfs_emit(buf, "0x%x\n", 0x404);
}

static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL);
Expand All @@ -735,9 +734,9 @@ static ssize_t info##num##_show(struct device *dev, struct device_attribute *att
\
if (num > card->num_info) \
return -ENODATA; \
if (!card->info[num-1][0]) \
if (!card->info[num - 1][0]) \
return 0; \
return sprintf(buf, "%s\n", card->info[num-1]); \
return sysfs_emit(buf, "%s\n", card->info[num - 1]); \
} \
static DEVICE_ATTR_RO(info##num)

Expand Down
5 changes: 3 additions & 2 deletions drivers/mmc/core/sdio.c
View file
Expand Up @@ -7,6 +7,7 @@

#include <linux/err.h>
#include <linux/pm_runtime.h>
#include <linux/sysfs.h>

#include <linux/mmc/host.h>
#include <linux/mmc/card.h>
Expand Down Expand Up @@ -40,9 +41,9 @@ static ssize_t info##num##_show(struct device *dev, struct device_attribute *att
\
if (num > card->num_info) \
return -ENODATA; \
if (!card->info[num-1][0]) \
if (!card->info[num - 1][0]) \
return 0; \
return sprintf(buf, "%s\n", card->info[num-1]); \
return sysfs_emit(buf, "%s\n", card->info[num - 1]); \
} \
static DEVICE_ATTR_RO(info##num)

Expand Down
7 changes: 4 additions & 3 deletions drivers/mmc/core/sdio_bus.c
View file
Expand Up @@ -14,6 +14,7 @@
#include <linux/pm_runtime.h>
#include <linux/pm_domain.h>
#include <linux/acpi.h>
#include <linux/sysfs.h>

#include <linux/mmc/card.h>
#include <linux/mmc/host.h>
Expand All @@ -35,7 +36,7 @@ field##_show(struct device *dev, struct device_attribute *attr, char *buf) \
struct sdio_func *func; \
\
func = dev_to_sdio_func (dev); \
return sprintf(buf, format_string, args); \
return sysfs_emit(buf, format_string, args); \
} \
static DEVICE_ATTR_RO(field)

Expand All @@ -52,9 +53,9 @@ static ssize_t info##num##_show(struct device *dev, struct device_attribute *att
\
if (num > func->num_info) \
return -ENODATA; \
if (!func->info[num-1][0]) \
if (!func->info[num - 1][0]) \
return 0; \
return sprintf(buf, "%s\n", func->info[num-1]); \
return sysfs_emit(buf, "%s\n", func->info[num - 1]); \
} \
static DEVICE_ATTR_RO(info##num)

Expand Down

0 comments on commit c4ab657

Please sign in to comment.