From 2efc459d06f1630001e3984854848a5647086232 Mon Sep 17 00:00:00 2001

From: Joe Perches <joe@perches.com>

Date: Wed, 16 Sep 2020 13:40:38 -0700

Subject: [PATCH] sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs

 output

Git-commit: 2efc459d06f1630001e3984854848a5647086232

Patch-mainline: v5.10-rc1

References: bsc#1200598 CVE-2022-20166

Output defects can exist in sysfs content using sprintf and snprintf.

sprintf does not know the PAGE_SIZE maximum of the temporary buffer

used for outputting sysfs content and it's possible to overrun the

PAGE_SIZE buffer length.

Add a generic sysfs_emit function that knows that the size of the

temporary buffer and ensures that no overrun is done.

Add a generic sysfs_emit_at function that can be used in multiple

call situations that also ensures that no overrun is done.

Validate the output buffer argument to be page aligned.

Validate the offset len argument to be within the PAGE_SIZE buf.

Signed-off-by: Joe Perches <joe@perches.com>

Link: https://lore.kernel.org/r/884235202216d464d61ee975f7465332c86f76b2.1600285923.git.joe@perches.com

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Acked-by: Petr Mladek <pmladek@suse.com>

[pmladek@suse.com: Removed changes in the documentation. The new API is not

	used everywhere in the old code base.

]

---

 fs/sysfs/file.c       |   55 ++++++++++++++++++++++++++++++++++++++++++++++++++

 include/linux/sysfs.h |   16 ++++++++++++++

 2 files changed, 71 insertions(+)

--- a/fs/sysfs/file.c

+++ b/fs/sysfs/file.c

@@ -17,6 +17,7 @@

 #include <linux/list.h>

 #include <linux/mutex.h>

 #include <linux/seq_file.h>

+#include <linux/mm.h>

 #include "sysfs.h"

 #include "../kernfs/kernfs-internal.h"

@@ -549,3 +550,57 @@ void sysfs_remove_bin_file(struct kobjec

 	kernfs_remove_by_name(kobj->sd, attr->attr.name);

 }

 EXPORT_SYMBOL_GPL(sysfs_remove_bin_file);

+

+/**

+ *	sysfs_emit - scnprintf equivalent, aware of PAGE_SIZE buffer.

+ *	@buf:	start of PAGE_SIZE buffer.

+ *	@fmt:	format

+ *	@...:	optional arguments to @format

+ *

+ *

+ * Returns number of characters written to @buf.

+ */

+int sysfs_emit(char *buf, const char *fmt, ...)

+{

+	va_list args;

+	int len;

+

+	if (WARN(!buf || offset_in_page(buf),

+		 "invalid sysfs_emit: buf:%p\n", buf))

+		return 0;

+

+	va_start(args, fmt);

+	len = vscnprintf(buf, PAGE_SIZE, fmt, args);

+	va_end(args);

+

+	return len;

+}

+EXPORT_SYMBOL_GPL(sysfs_emit);

+

+/**

+ *	sysfs_emit_at - scnprintf equivalent, aware of PAGE_SIZE buffer.

+ *	@buf:	start of PAGE_SIZE buffer.

+ *	@at:	offset in @buf to start write in bytes

+ *		@at must be >= 0 && < PAGE_SIZE

+ *	@fmt:	format

+ *	@...:	optional arguments to @fmt

+ *

+ *

+ * Returns number of characters written starting at &@buf[@at].

+ */

+int sysfs_emit_at(char *buf, int at, const char *fmt, ...)

+{

+	va_list args;

+	int len;

+

+	if (WARN(!buf || offset_in_page(buf) || at < 0 || at >= PAGE_SIZE,

+		 "invalid sysfs_emit_at: buf:%p at:%d\n", buf, at))

+		return 0;

+

+	va_start(args, fmt);

+	len = vscnprintf(buf + at, PAGE_SIZE - at, fmt, args);

+	va_end(args);

+

+	return len;

+}

+EXPORT_SYMBOL_GPL(sysfs_emit_at);

--- a/include/linux/sysfs.h

+++ b/include/linux/sysfs.h

@@ -300,6 +300,11 @@ static inline void sysfs_enable_ns(struc

 	return kernfs_enable_ns(kn);

 }

+__printf(2, 3)

+int sysfs_emit(char *buf, const char *fmt, ...);

+__printf(3, 4)

+int sysfs_emit_at(char *buf, int at, const char *fmt, ...);

+

 #else /* CONFIG_SYSFS */

 static inline int sysfs_create_dir_ns(struct kobject *kobj, const void *ns)

@@ -506,6 +511,17 @@ static inline void sysfs_enable_ns(struc

 {

 }

+__printf(2, 3)

+static inline int sysfs_emit(char *buf, const char *fmt, ...)

+{

+	return 0;

+}

+

+__printf(3, 4)

+static inline int sysfs_emit_at(char *buf, int at, const char *fmt, ...)

+{

+	return 0;

+}

 #endif /* CONFIG_SYSFS */

 static inline int __must_check sysfs_create_file(struct kobject *kobj,