On Mon, Aug 24, 2026 at 11:46 PM Qingshuang Fu <[email protected]> wrote: > > From: Qingshuang Fu <[email protected]> > > get_clocksources() and get_cur_clocksource() open and read the > clocksource sysfs files without checking the return values and without > NUL-terminating the buffer. > > If open() fails, read() is called on fd -1 and returns -1, which is > stored in a size_t as SIZE_MAX. The token-scanning loop in > get_clocksources() then walks past the uninitialized stack buffer, > reading and writing out of bounds. Even on success the buffer is not > NUL-terminated, so a fully read buffer makes the inner scan run past the > data, and get_cur_clocksource() lets change_clocksource() call strlen() > on a non-terminated buffer. > > Check the open()/read() results, use ssize_t for the read length, > NUL-terminate the buffer, and close the fd in get_cur_clocksource(). > > Fixes: 7290ce1423c3 ("selftests/timers: Add clocksource-switch test from > timetest suite") > Signed-off-by: Qingshuang Fu <[email protected]>
Acked-by: John Stultz <[email protected]>
