powerpc/powernv: Check sysparam size before creation

The size of the sysparam sysfs files is determined from the device tree at boot. However the buffer is hard coded to 64 bytes. If we encounter a parameter that is larger than 64, or miss-parse the device tree, the buffer will overflow when reading or writing to the parameter. Check it at discovery time, and if the parameter is too large, do not create a sysfs entry for it. Signed-off-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/powernv: Check sysparam size before creation
The size of the sysparam sysfs files is determined from the device tree at boot. However the buffer is hard coded to 64 bytes. If we encounter a parameter that is larger than 64, or miss-parse the device tree, the buffer will overflow when reading or writing to the parameter. Check it at discovery time, and if the parameter is too large, do not create a sysfs entry for it. Signed-off-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Joel Stanley · Benjamin Herrenschmidt
1 parent 16003d235b
Showing 1 changed file with 6 additions and 0 deletions Side-by-side Diff
arch/powerpc/platforms/powernv/opal-sysparam.c
@@ -241,6 +241,12 @@
  
 	/* For each of the parameters, populate the parameter attributes */
 	for (i = 0; i < count; i++) {
+		if (size[i] > MAX_PARAM_DATA_LEN) {
+			pr_warn("SYSPARAM: Not creating parameter %d as size "
+				"exceeds buffer length\n", i);
+			continue;
+		}
+
 		sysfs_attr_init(&attr[i].kobj_attr.attr);
 		attr[i].param_id = id[i];
 		attr[i].param_size = size[i];
...	...	@@ -241,6 +241,12 @@
241	241
242	242	/* For each of the parameters, populate the parameter attributes */
243	243	for (i = 0; i < count; i++) {
	244	+ if (size[i] > MAX_PARAM_DATA_LEN) {
	245	+ pr_warn("SYSPARAM: Not creating parameter %d as size "
	246	+ "exceeds buffer length\n", i);
	247	+ continue;
	248	+ }
	249	+
244	250	sysfs_attr_init(&attr[i].kobj_attr.attr);
245	251	attr[i].param_id = id[i];
246	252	attr[i].param_size = size[i];