Re: [PATCH 2/3] leds/class: Check snprintf return value
On Mon, Mar 30, 2015 at 4:08 AM, Ricardo Ribalda Delgado wrote: > If the final name does not fit the string there is a potential > endless-loop. > > Reported-by: Geert Uytterhoeven > Signed-off-by: Ricardo Ribalda Delgado > --- > drivers/leds/led-class.c | 10 +- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c > index 294d6d6..2ffe8b1 100644 > --- a/drivers/leds/led-class.c > +++ b/drivers/leds/led-class.c > @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char > *init_name, char *name, > size_t len) > { > int i = 0; > + int ret = 0; > > strlcpy(name, init_name, len); > > - while (class_find_device(leds_class, NULL, name, match_name)) > + while (class_find_device(leds_class, NULL, name, match_name) && > + (ret < len)) > snprintf(name, len, "%s_%d", init_name, ++i); class_find_device will get a reference for a device. That reference must be dropped using put_device(). See the definition for class_find_device in drivers/base/class.c and other usage examples in the kernel. So this function call will only work the first time. Alan Tull > > + if (ret >= len) > + return -ENOMEM; > + > return i; > } > > @@ -243,6 +248,9 @@ int led_classdev_register(struct device *parent, struct > led_classdev *led_cdev) > int ret; > > ret = led_classdev_next_name(led_cdev->name, name, sizeof(name)); > + if (ret < 0) > + return ret; > + > led_cdev->dev = device_create_with_groups(leds_class, parent, 0, > led_cdev, led_cdev->groups, "%s", name); > if (IS_ERR(led_cdev->dev)) > -- > 2.1.4 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majord...@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 2/3] leds/class: Check snprintf return value
On Mon, Mar 30, 2015 at 4:08 AM, Ricardo Ribalda Delgado ricardo.riba...@gmail.com wrote: If the final name does not fit the string there is a potential endless-loop. Reported-by: Geert Uytterhoeven ge...@linux-m68k.org Signed-off-by: Ricardo Ribalda Delgado ricardo.riba...@gmail.com --- drivers/leds/led-class.c | 10 +- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c index 294d6d6..2ffe8b1 100644 --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char *init_name, char *name, size_t len) { int i = 0; + int ret = 0; strlcpy(name, init_name, len); - while (class_find_device(leds_class, NULL, name, match_name)) + while (class_find_device(leds_class, NULL, name, match_name) + (ret len)) snprintf(name, len, %s_%d, init_name, ++i); class_find_device will get a reference for a device. That reference must be dropped using put_device(). See the definition for class_find_device in drivers/base/class.c and other usage examples in the kernel. So this function call will only work the first time. Alan Tull + if (ret = len) + return -ENOMEM; + return i; } @@ -243,6 +248,9 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev) int ret; ret = led_classdev_next_name(led_cdev-name, name, sizeof(name)); + if (ret 0) + return ret; + led_cdev-dev = device_create_with_groups(leds_class, parent, 0, led_cdev, led_cdev-groups, %s, name); if (IS_ERR(led_cdev-dev)) -- 2.1.4 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 2/3] leds/class: Check snprintf return value
If the final name does not fit the string there is a potential endless-loop. Reported-by: Geert Uytterhoeven Signed-off-by: Ricardo Ribalda Delgado --- drivers/leds/led-class.c | 10 +- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c index 294d6d6..2ffe8b1 100644 --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char *init_name, char *name, size_t len) { int i = 0; + int ret = 0; strlcpy(name, init_name, len); - while (class_find_device(leds_class, NULL, name, match_name)) + while (class_find_device(leds_class, NULL, name, match_name) && + (ret < len)) snprintf(name, len, "%s_%d", init_name, ++i); + if (ret >= len) + return -ENOMEM; + return i; } @@ -243,6 +248,9 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev) int ret; ret = led_classdev_next_name(led_cdev->name, name, sizeof(name)); + if (ret < 0) + return ret; + led_cdev->dev = device_create_with_groups(leds_class, parent, 0, led_cdev, led_cdev->groups, "%s", name); if (IS_ERR(led_cdev->dev)) -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 2/3] leds/class: Check snprintf return value
If the final name does not fit the string there is a potential endless-loop. Reported-by: Geert Uytterhoeven Signed-off-by: Ricardo Ribalda Delgado --- drivers/leds/led-class.c | 10 +- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c index 294d6d6..2ffe8b1 100644 --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char *init_name, char *name, size_t len) { int i = 0; + int ret = 0; strlcpy(name, init_name, len); - while (class_find_device(leds_class, NULL, name, match_name)) + while (class_find_device(leds_class, NULL, name, match_name) && + (ret < len)) snprintf(name, len, "%s_%d", init_name, ++i); + if (ret >= len) + return -ENOMEM; + return i; } @@ -243,6 +248,9 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev) int ret; ret = led_classdev_next_name(led_cdev->name, name, sizeof(name)); + if (ret < 0) + return ret; + led_cdev->dev = device_create_with_groups(leds_class, parent, 0, led_cdev, led_cdev->groups, "%s", name); if (IS_ERR(led_cdev->dev)) -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 2/3] leds/class: Check snprintf return value
On Mon, Mar 30, 2015 at 10:55 AM, Ricardo Ribalda Delgado wrote: > --- a/drivers/leds/led-class.c > +++ b/drivers/leds/led-class.c > @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char > *init_name, char *name, > size_t len) > { > int i = 0; > + int ret = 0; > > strlcpy(name, init_name, len); > > - while (class_find_device(leds_class, NULL, name, match_name)) > + while (class_find_device(leds_class, NULL, name, match_name) && > + (ret < len)) > snprintf(name, len, "%s_%d", init_name, ++i); Missing "ret = " Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- ge...@linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 2/3] leds/class: Check snprintf return value
If the final name does not fit the string there is a potential endless-loop. Reported-by: Geert Uytterhoeven Signed-off-by: Ricardo Ribalda Delgado --- drivers/leds/led-class.c | 10 +- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c index 294d6d6..2ffe8b1 100644 --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char *init_name, char *name, size_t len) { int i = 0; + int ret = 0; strlcpy(name, init_name, len); - while (class_find_device(leds_class, NULL, name, match_name)) + while (class_find_device(leds_class, NULL, name, match_name) && + (ret < len)) snprintf(name, len, "%s_%d", init_name, ++i); + if (ret >= len) + return -ENOMEM; + return i; } @@ -243,6 +248,9 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev) int ret; ret = led_classdev_next_name(led_cdev->name, name, sizeof(name)); + if (ret < 0) + return ret; + led_cdev->dev = device_create_with_groups(leds_class, parent, 0, led_cdev, led_cdev->groups, "%s", name); if (IS_ERR(led_cdev->dev)) -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH 2/3] leds/class: Check snprintf return value
On Mon, Mar 30, 2015 at 10:55 AM, Ricardo Ribalda Delgado ricardo.riba...@gmail.com wrote: --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char *init_name, char *name, size_t len) { int i = 0; + int ret = 0; strlcpy(name, init_name, len); - while (class_find_device(leds_class, NULL, name, match_name)) + while (class_find_device(leds_class, NULL, name, match_name) + (ret len)) snprintf(name, len, %s_%d, init_name, ++i); Missing ret = Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- ge...@linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say programmer or something like that. -- Linus Torvalds -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 2/3] leds/class: Check snprintf return value
If the final name does not fit the string there is a potential endless-loop. Reported-by: Geert Uytterhoeven ge...@linux-m68k.org Signed-off-by: Ricardo Ribalda Delgado ricardo.riba...@gmail.com --- drivers/leds/led-class.c | 10 +- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c index 294d6d6..2ffe8b1 100644 --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char *init_name, char *name, size_t len) { int i = 0; + int ret = 0; strlcpy(name, init_name, len); - while (class_find_device(leds_class, NULL, name, match_name)) + while (class_find_device(leds_class, NULL, name, match_name) + (ret len)) snprintf(name, len, %s_%d, init_name, ++i); + if (ret = len) + return -ENOMEM; + return i; } @@ -243,6 +248,9 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev) int ret; ret = led_classdev_next_name(led_cdev-name, name, sizeof(name)); + if (ret 0) + return ret; + led_cdev-dev = device_create_with_groups(leds_class, parent, 0, led_cdev, led_cdev-groups, %s, name); if (IS_ERR(led_cdev-dev)) -- 2.1.4 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 2/3] leds/class: Check snprintf return value
If the final name does not fit the string there is a potential endless-loop. Reported-by: Geert Uytterhoeven ge...@linux-m68k.org Signed-off-by: Ricardo Ribalda Delgado ricardo.riba...@gmail.com --- drivers/leds/led-class.c | 10 +- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c index 294d6d6..2ffe8b1 100644 --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char *init_name, char *name, size_t len) { int i = 0; + int ret = 0; strlcpy(name, init_name, len); - while (class_find_device(leds_class, NULL, name, match_name)) + while (class_find_device(leds_class, NULL, name, match_name) + (ret len)) snprintf(name, len, %s_%d, init_name, ++i); + if (ret = len) + return -ENOMEM; + return i; } @@ -243,6 +248,9 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev) int ret; ret = led_classdev_next_name(led_cdev-name, name, sizeof(name)); + if (ret 0) + return ret; + led_cdev-dev = device_create_with_groups(leds_class, parent, 0, led_cdev, led_cdev-groups, %s, name); if (IS_ERR(led_cdev-dev)) -- 2.1.4 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 2/3] leds/class: Check snprintf return value
If the final name does not fit the string there is a potential endless-loop. Reported-by: Geert Uytterhoeven ge...@linux-m68k.org Signed-off-by: Ricardo Ribalda Delgado ricardo.riba...@gmail.com --- drivers/leds/led-class.c | 10 +- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c index 294d6d6..2ffe8b1 100644 --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -223,12 +223,17 @@ static int led_classdev_next_name(const char *init_name, char *name, size_t len) { int i = 0; + int ret = 0; strlcpy(name, init_name, len); - while (class_find_device(leds_class, NULL, name, match_name)) + while (class_find_device(leds_class, NULL, name, match_name) + (ret len)) snprintf(name, len, %s_%d, init_name, ++i); + if (ret = len) + return -ENOMEM; + return i; } @@ -243,6 +248,9 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev) int ret; ret = led_classdev_next_name(led_cdev-name, name, sizeof(name)); + if (ret 0) + return ret; + led_cdev-dev = device_create_with_groups(leds_class, parent, 0, led_cdev, led_cdev-groups, %s, name); if (IS_ERR(led_cdev-dev)) -- 2.1.4 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/