[v1] egalax_ts_serial: Fix potential buffer overflow

[PATCH] egalax_ts_serial: Fix potential buffer overflow

Posted by Zoltán Böszörményi 2 years ago

Update my old (defunct) email addresses in passing.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311171716.uIQY5rT4-lkp@intel.com/
Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
---
 CREDITS                                      | 3 ++-
 drivers/input/touchscreen/egalax_ts_serial.c | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/CREDITS b/CREDITS
index f33a33fd2371..5efccb40d577 100644
--- a/CREDITS
+++ b/CREDITS
@@ -470,8 +470,9 @@ S: Montreal, Quebec
 S: Canada
 
 N: Zoltán Böszörményi
-E: zboszor@mail.externet.hu
+E: zboszor@gmail.com
 D: MTRR emulation with Cyrix style ARR registers, Athlon MTRR support
+D: eGalax serial touchscreen support
 
 N: John Boyd
 E: boyd@cis.ohio-state.edu
diff --git a/drivers/input/touchscreen/egalax_ts_serial.c b/drivers/input/touchscreen/egalax_ts_serial.c
index 375922d3a6d1..f8b56896a42f 100644
--- a/drivers/input/touchscreen/egalax_ts_serial.c
+++ b/drivers/input/touchscreen/egalax_ts_serial.c
@@ -2,7 +2,7 @@
 /*
  * EETI Egalax serial touchscreen driver
  *
- * Copyright (c) 2015 Zoltán Böszörményi <zboszor@pr.hu>
+ * Copyright (c) 2015 Zoltán Böszörményi <zboszor@gmail.com>
  *
  * based on the
  *
@@ -42,7 +42,7 @@ struct egalax {
 	struct serio *serio;
 	int idx;
 	u8 data[EGALAX_FORMAT_MAX_LENGTH];
-	char phys[32];
+	char phys[NAME_MAX];
 };
 
 static void egalax_process_data(struct egalax *egalax)
@@ -185,6 +185,6 @@ static struct serio_driver egalax_drv = {
 };
 module_serio_driver(egalax_drv);
 
-MODULE_AUTHOR("Zoltán Böszörményi <zboszor@pr.hu>");
+MODULE_AUTHOR("Zoltán Böszörményi <zboszor@gmail.com>");
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL v2");
-- 
2.42.0

Re: [PATCH] egalax_ts_serial: Fix potential buffer overflow

Posted by Dmitry Torokhov 2 years ago

Hi Zoltán,

On Sun, Dec 03, 2023 at 10:06:00AM +0100, Zoltán Böszörményi wrote:
> @@ -42,7 +42,7 @@ struct egalax {
>  	struct serio *serio;
>  	int idx;
>  	u8 data[EGALAX_FORMAT_MAX_LENGTH];
> -	char phys[32];
> +	char phys[NAME_MAX];

This simply wastes 200+ bytes for no good reason. It is perfectly fine
to truncate phys string (which does not happen in practice).

If you feel strongly about it then maybe use devm_kasprintf() to
allocate the needed buffer.

Thanks.

-- 
Dmitry

Re: [PATCH] egalax_ts_serial: Fix potential buffer overflow

Posted by Böszörményi Zoltán 2 years ago

2023. 12. 03. 19:35 keltezéssel, Dmitry Torokhov írta:
> Hi Zoltán,
>
> On Sun, Dec 03, 2023 at 10:06:00AM +0100, Zoltán Böszörményi wrote:
>> @@ -42,7 +42,7 @@ struct egalax {
>>   	struct serio *serio;
>>   	int idx;
>>   	u8 data[EGALAX_FORMAT_MAX_LENGTH];
>> -	char phys[32];
>> +	char phys[NAME_MAX];
> This simply wastes 200+ bytes for no good reason. It is perfectly fine
> to truncate phys string (which does not happen in practice).

Okay, I modified the phys[] array to just be 40 bytes.
That's not that wasteful and still avoids the warning.

I noticed that other TS drivers emit the same warning.

>
> If you feel strongly about it then maybe use devm_kasprintf() to
> allocate the needed buffer.
>
> Thanks.
>

[PATCH v2] egalax_ts_serial: Fix potential buffer overflow

Posted by Zoltán Böszörményi 2 years ago

Increase phys[] array size to 40 bytes to avoid
this warning:

  CC [M]  drivers/input/touchscreen/egalax_ts_serial.o
drivers/input/touchscreen/egalax_ts_serial.c: In function ‘egalax_connect’:
drivers/input/touchscreen/egalax_ts_serial.c:112:21: warning: ‘/input0’ directive output may be truncated writing 7 bytes into a region of size between 1 and 32 [-Wformat-truncation=]
  112 |                  "%s/input0", serio->phys);
      |                     ^~~~~~~
drivers/input/touchscreen/egalax_ts_serial.c:111:9: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
  111 |         snprintf(egalax->phys, sizeof(egalax->phys),
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  112 |                  "%s/input0", serio->phys);
      |                  ~~~~~~~~~~~~~~~~~~~~~~~~~

Update my old (defunct) email addresses in passing.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311171716.uIQY5rT4-lkp@intel.com/
Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
---
 CREDITS                                      | 3 ++-
 drivers/input/touchscreen/egalax_ts_serial.c | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/CREDITS b/CREDITS
index f33a33fd2371..5efccb40d577 100644
--- a/CREDITS
+++ b/CREDITS
@@ -470,8 +470,9 @@ S: Montreal, Quebec
 S: Canada
 
 N: Zoltán Böszörményi
-E: zboszor@mail.externet.hu
+E: zboszor@gmail.com
 D: MTRR emulation with Cyrix style ARR registers, Athlon MTRR support
+D: eGalax serial touchscreen support
 
 N: John Boyd
 E: boyd@cis.ohio-state.edu
diff --git a/drivers/input/touchscreen/egalax_ts_serial.c b/drivers/input/touchscreen/egalax_ts_serial.c
index 375922d3a6d1..390b3a670bfa 100644
--- a/drivers/input/touchscreen/egalax_ts_serial.c
+++ b/drivers/input/touchscreen/egalax_ts_serial.c
@@ -2,7 +2,7 @@
 /*
  * EETI Egalax serial touchscreen driver
  *
- * Copyright (c) 2015 Zoltán Böszörményi <zboszor@pr.hu>
+ * Copyright (c) 2015 Zoltán Böszörményi <zboszor@gmail.com>
  *
  * based on the
  *
@@ -42,7 +42,7 @@ struct egalax {
 	struct serio *serio;
 	int idx;
 	u8 data[EGALAX_FORMAT_MAX_LENGTH];
-	char phys[32];
+	char phys[40];
 };
 
 static void egalax_process_data(struct egalax *egalax)
@@ -185,6 +185,6 @@ static struct serio_driver egalax_drv = {
 };
 module_serio_driver(egalax_drv);
 
-MODULE_AUTHOR("Zoltán Böszörményi <zboszor@pr.hu>");
+MODULE_AUTHOR("Zoltán Böszörményi <zboszor@gmail.com>");
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL v2");
-- 
2.43.0