| Message ID | 20210526092020.554341-2-chenhuang5@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [-next,1/3] powerpc/rtas: Replaced simple_strtoull() with kstrtoull() | expand |
From: Chen Huang > Sent: 26 May 2021 10:20 > > The simple_strtoull() function is deprecated in some situation, since > it does not check for the range overflow, use kstrtoull() instead. > ... > - target_bytes = simple_strtoull(buf, &endchar, 0) * 1024; > + ret = kstrtoull(buf, 0, &target_bytes); > + if (ret) > + return ret; > + target_bytes *= 1024; I'd have thought it was more important to check *endchar than overflow. If you are worried about overflow you need a range check before the multiply. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
On Thu, May 27, 2021 at 02:10:21PM +0000, David Laight wrote: > From: Chen Huang > > Sent: 26 May 2021 10:20 > > > > The simple_strtoull() function is deprecated in some situation, since > > it does not check for the range overflow, use kstrtoull() instead. > > > ... > > - target_bytes = simple_strtoull(buf, &endchar, 0) * 1024; > > + ret = kstrtoull(buf, 0, &target_bytes); > > + if (ret) > > + return ret; > > + target_bytes *= 1024; > > I'd have thought it was more important to check *endchar > than overflow. That's one of the differences between simple_strtoull() and kstrtoull(). The simple_strtoull() will accept a string like "123ABC", but kstrtoull() will only accept NUL terminated numbers or a newline followed by a NUL terminator. Which is fine in this context because users will be doing "echo 1234 > /sys/foo". > If you are worried about overflow you need a range check > before the multiply. This is probably a case where if the users cause an integer overflow then they get what they deserve. regards, dan carpenter
diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c index a8d24433c8e9..1fba838963d2 100644 --- a/drivers/xen/xen-balloon.c +++ b/drivers/xen/xen-balloon.c @@ -163,13 +163,16 @@ static ssize_t store_target_kb(struct device *dev, const char *buf, size_t count) { - char *endchar; + ssize_t ret; unsigned long long target_bytes; if (!capable(CAP_SYS_ADMIN)) return -EPERM; - target_bytes = simple_strtoull(buf, &endchar, 0) * 1024; + ret = kstrtoull(buf, 0, &target_bytes); + if (ret) + return ret; + target_bytes *= 1024; balloon_set_new_target(target_bytes >> PAGE_SHIFT);
The simple_strtoull() function is deprecated in some situation, since it does not check for the range overflow, use kstrtoull() instead. Signed-off-by: Chen Huang <chenhuang5@huawei.com> --- drivers/xen/xen-balloon.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)