| Message ID | 20200113191226.14903-1-kamalheib1@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Jason Gunthorpe |
| Headers | show |
| Series | [for-next] RDMA/core: Fix storing node description | expand |
On Mon, Jan 13, 2020 at 09:12:26PM +0200, Kamal Heib wrote: > Make sure to return -EINVAL when the supplied string is bigger then > IB_DEVICE_NODE_DESC_MAX. > > Fixes: c5bcbbb9fe00 ("IB: Allow userspace to set node description") > Signed-off-by: Kamal Heib <kamalheib1@gmail.com> > drivers/infiniband/core/sysfs.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c > index 087682e6969e..55f4d7c1fcc9 100644 > +++ b/drivers/infiniband/core/sysfs.c > @@ -1265,10 +1265,13 @@ static ssize_t node_desc_store(struct device *device, > struct ib_device_modify desc = {}; > int ret; > > + if (count > IB_DEVICE_NODE_DESC_MAX) > + return -EINVAL; > + > if (!dev->ops.modify_device) > return -EOPNOTSUPP; > > - memcpy(desc.node_desc, buf, min_t(int, count, IB_DEVICE_NODE_DESC_MAX)); > + memcpy(desc.node_desc, buf, count); I think this should just be written as if (strscpy(desc.node_desc, buf, sizeof(desc.node_desc)) == -E2BIG) return -EINVAL; Jason
On Mon, Jan 13, 2020 at 04:16:42PM -0400, Jason Gunthorpe wrote: > On Mon, Jan 13, 2020 at 09:12:26PM +0200, Kamal Heib wrote: > > Make sure to return -EINVAL when the supplied string is bigger then > > IB_DEVICE_NODE_DESC_MAX. > > > > Fixes: c5bcbbb9fe00 ("IB: Allow userspace to set node description") > > Signed-off-by: Kamal Heib <kamalheib1@gmail.com> > > drivers/infiniband/core/sysfs.c | 5 ++++- > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c > > index 087682e6969e..55f4d7c1fcc9 100644 > > +++ b/drivers/infiniband/core/sysfs.c > > @@ -1265,10 +1265,13 @@ static ssize_t node_desc_store(struct device *device, > > struct ib_device_modify desc = {}; > > int ret; > > > > + if (count > IB_DEVICE_NODE_DESC_MAX) > > + return -EINVAL; > > + > > if (!dev->ops.modify_device) > > return -EOPNOTSUPP; > > > > - memcpy(desc.node_desc, buf, min_t(int, count, IB_DEVICE_NODE_DESC_MAX)); > > + memcpy(desc.node_desc, buf, count); > > I think this should just be written as > > if (strscpy(desc.node_desc, buf, sizeof(desc.node_desc)) == -E2BIG) > return -EINVAL; > OK, I'll send a V2 soon. > Jason
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c index 087682e6969e..55f4d7c1fcc9 100644 --- a/drivers/infiniband/core/sysfs.c +++ b/drivers/infiniband/core/sysfs.c @@ -1265,10 +1265,13 @@ static ssize_t node_desc_store(struct device *device, struct ib_device_modify desc = {}; int ret; + if (count > IB_DEVICE_NODE_DESC_MAX) + return -EINVAL; + if (!dev->ops.modify_device) return -EOPNOTSUPP; - memcpy(desc.node_desc, buf, min_t(int, count, IB_DEVICE_NODE_DESC_MAX)); + memcpy(desc.node_desc, buf, count); ret = ib_modify_device(dev, IB_DEVICE_MODIFY_NODE_DESC, &desc); if (ret) return ret;
Make sure to return -EINVAL when the supplied string is bigger then IB_DEVICE_NODE_DESC_MAX. Fixes: c5bcbbb9fe00 ("IB: Allow userspace to set node description") Signed-off-by: Kamal Heib <kamalheib1@gmail.com> --- drivers/infiniband/core/sysfs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)