target/linux/generic/backport-5.10/828-v6.4-0001-of-Fix-modalias-string-generation.patch

   1 From b19a4266c52de78496fe40f0b37580a3b762e67d Mon Sep 17 00:00:00 2001
   2 From: Miquel Raynal <miquel.raynal@bootlin.com>
   3 Date: Tue, 4 Apr 2023 18:21:09 +0100
   4 Subject: [PATCH] of: Fix modalias string generation
   5
   6 The helper generating an OF based modalias (of_device_get_modalias())
   7 works fine, but due to the use of snprintf() internally it needs a
   8 buffer one byte longer than what should be needed just for the entire
   9 string (excluding the '\0'). Most users of this helper are sysfs hooks
  10 providing the modalias string to users. They all provide a PAGE_SIZE
  11 buffer which is way above the number of bytes required to fit the
  12 modalias string and hence do not suffer from this issue.
  13
  14 There is another user though, of_device_request_module(), which is only
  15 called by drivers/usb/common/ulpi.c. This request module function is
  16 faulty, but maybe because in most cases there is an alternative, ULPI
  17 driver users have not noticed it.
  18
  19 In this function, of_device_get_modalias() is called twice. The first
  20 time without buffer just to get the number of bytes required by the
  21 modalias string (excluding the null byte), and a second time, after
  22 buffer allocation, to fill the buffer. The allocation asks for an
  23 additional byte, in order to store the trailing '\0'. However, the
  24 buffer *length* provided to of_device_get_modalias() excludes this extra
  25 byte. The internal use of snprintf() with a length that is exactly the
  26 number of bytes to be written has the effect of using the last available
  27 byte to store a '\0', which then smashes the last character of the
  28 modalias string.
  29
  30 Provide the actual size of the buffer to of_device_get_modalias() to fix
  31 this issue.
  32
  33 Note: the "str[size - 1] = '\0';" line is not really needed as snprintf
  34 will anyway end the string with a null byte, but there is a possibility
  35 that this function might be called on a struct device_node without
  36 compatible, in this case snprintf() would not be executed. So we keep it
  37 just to avoid possible unbounded strings.
  38
  39 Cc: Stephen Boyd <sboyd@kernel.org>
  40 Cc: Peter Chen <peter.chen@kernel.org>
  41 Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias")
  42 Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
  43 Reviewed-by: Rob Herring <robh@kernel.org>
  44 Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
  45 Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org
  46 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  47 ---
  48  drivers/of/device.c | 7 +++++--
  49  1 file changed, 5 insertions(+), 2 deletions(-)
  50
  51 --- a/drivers/of/device.c
  52 +++ b/drivers/of/device.c
  53 @@ -264,12 +264,15 @@ int of_device_request_module(struct devi
  54         if (size < 0)
  55                 return size;
  56
  57 -       str = kmalloc(size + 1, GFP_KERNEL);
  58 +       /* Reserve an additional byte for the trailing '\0' */
  59 +       size++;
  60 +
  61 +       str = kmalloc(size, GFP_KERNEL);
  62         if (!str)
  63                 return -ENOMEM;
  64
  65         of_device_get_modalias(dev, str, size);
  66 -       str[size] = '\0';
  67 +       str[size - 1] = '\0';
  68         ret = request_module(str);
  69         kfree(str);
  70