[PATCH] fb: sm501fb off-by-1 sysfs store

Currently sm501fb_crtsrc_store() won't allow the routing to be changed
via echos from userspace in to the sysfs file. The reason for this is
that the strnicmp() for both heads uses a sizeof() for the string length,
which ends up being strlen() + 1 (\0 in the normal case, but the echo
gives a newline, which is where the issue occurs), this then causes a
mismatch and subsequently bails with the -EINVAL.

In addition to this, the hardcoded lengths were then used for the store
length that was returned, which ended up being erroneous and resulting in
a write error. There's also no point in returning anything but the full
length since it will -EINVAL out on a mismatch well before then anyways.

sizeof("string") is great for making sure you have space in your buffer,
but rather less so for string comparisons :-)

Signed-off-by: Paul Mundt <redacted>

--

 drivers/video/sm501fb.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c
index 02b290c..72b5358 100644
--- a/drivers/video/sm501fb.c
+++ b/drivers/video/sm501fb.c

@@ -1074,9 +1074,9 @@ static ssize_t sm501fb_crtsrc_store(struct device *dev,
 	if (len < 1)
 		return -EINVAL;
 
-	if (strnicmp(buf, "crt", sizeof("crt")) == 0)
+	if (strnicmp(buf, "crt", 3) == 0)
 		head = HEAD_CRT;
-	else if (strnicmp(buf, "panel", sizeof("panel")) == 0)
+	else if (strnicmp(buf, "panel", 5) == 0)
 		head = HEAD_PANEL;
 	else
 		return -EINVAL;

@@ -1098,7 +1098,7 @@ static ssize_t sm501fb_crtsrc_store(struct device *dev,
 	writel(ctrl, info->regs + SM501_DC_CRT_CONTROL);
 	sm501fb_sync_regs(info);
 
-	return (head == HEAD_CRT) ? 3 : 5;
+	return len;
 }
 
 /* Prepare the device_attr for registration with sysfs later */

-------------------------------------------------------------------------

Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

On Thu, Mar 01, 2007 at 05:24:56PM +0900, Paul Mundt wrote:

Currently sm501fb_crtsrc_store() won't allow the routing to be changed
via echos from userspace in to the sysfs file. The reason for this is
that the strnicmp() for both heads uses a sizeof() for the string length,
which ends up being strlen() + 1 (\0 in the normal case, but the echo
gives a newline, which is where the issue occurs), this then causes a
mismatch and subsequently bails with the -EINVAL.

In addition to this, the hardcoded lengths were then used for the store
length that was returned, which ended up being erroneous and resulting in
a write error. There's also no point in returning anything but the full
length since it will -EINVAL out on a mismatch well before then anyways.

sizeof("string") is great for making sure you have space in your buffer,
but rather less so for string comparisons :-)

Signed-off-by: Paul Mundt <redacted>

Acked-by: Ben Dooks <ben-linux@fluff.org>

-- 
Ben (ben@fluff.org, http://www.fluff.org/)

  'a smiley only costs 4 bytes'

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

On Thu, 1 Mar 2007, Paul Mundt wrote:

Currently sm501fb_crtsrc_store() won't allow the routing to be changed
via echos from userspace in to the sysfs file. The reason for this is
that the strnicmp() for both heads uses a sizeof() for the string length,
which ends up being strlen() + 1 (\0 in the normal case, but the echo
gives a newline, which is where the issue occurs), this then causes a
mismatch and subsequently bails with the -EINVAL.

sizeof("string") is great for making sure you have space in your buffer,
but rather less so for string comparisons :-)

What about using just `strlen("string")' instead? ISTR gcc optimizes this to a
constant. Not that it matters that much, as the actual string won't be
duplicated.

Gr{oetje,eeting}s,

						Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
							    -- Linus Torvalds

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

On Thu, Mar 01, 2007 at 02:25:55PM +0100, Geert Uytterhoeven wrote:

On Thu, 1 Mar 2007, Paul Mundt wrote:

quoted

@@ -1074,9 +1074,9 @@ static ssize_t sm501fb_crtsrc_store(struct device *dev,
 	if (len < 1)
 		return -EINVAL;
 
-	if (strnicmp(buf, "crt", sizeof("crt")) == 0)
+	if (strnicmp(buf, "crt", 3) == 0)
 		head = HEAD_CRT;
-	else if (strnicmp(buf, "panel", sizeof("panel")) == 0)
+	else if (strnicmp(buf, "panel", 5) == 0)
 		head = HEAD_PANEL;
 	else
 		return -EINVAL;

What about using just `strlen("string")' instead? ISTR gcc optimizes this to a
constant. Not that it matters that much, as the actual string won't be
duplicated.

I stuck with the constants since they were already referenced in the
function, and there are enough other places in the kernel where they're
used for these things. I didn't figure that 5 was a terribly high number
to count to, but if there's expected difficulty, strlen() is of course an
option.

Personally I find it less visually offensive with constants, but as long
as the end number is the same, I'm not too concerned with how we get
there. Feel free to change it if you wish.

Paul Mundt wrote:

On Thu, Mar 01, 2007 at 02:25:55PM +0100, Geert Uytterhoeven wrote:

quoted

On Thu, 1 Mar 2007, Paul Mundt wrote:

quoted

@@ -1074,9 +1074,9 @@ static ssize_t sm501fb_crtsrc_store(struct device *dev,
 	if (len < 1)
 		return -EINVAL;
 
-	if (strnicmp(buf, "crt", sizeof("crt")) == 0)
+	if (strnicmp(buf, "crt", 3) == 0)
 		head = HEAD_CRT;
-	else if (strnicmp(buf, "panel", sizeof("panel")) == 0)
+	else if (strnicmp(buf, "panel", 5) == 0)
 		head = HEAD_PANEL;
 	else
 		return -EINVAL;

What about using just `strlen("string")' instead? ISTR gcc optimizes this to a
constant. Not that it matters that much, as the actual string won't be
duplicated.

I stuck with the constants since they were already referenced in the
function, and there are enough other places in the kernel where they're
used for these things. I didn't figure that 5 was a terribly high number
to count to, but if there's expected difficulty, strlen() is of course an
option.

Personally I find it less visually offensive with constants, but as long
as the end number is the same, I'm not too concerned with how we get
there. Feel free to change it if you wish.

My personal preference is to use sizeof("string")-1:
- guaranteed to be optimized to a constant (better than strlen)
- less likely to be left alone when "string" becomes "a different string" 
(better than magic numbers)

I also prefer for repeated constants, either preprocessor macros (#define 
OPTION_CRT "crt") or constant char arrays (static const char Option_CRT[] = 
"crt"), or something like that, to ensure one copy of the string in the object. 
  But having the indirection here could add confusion for somebody trying to 
quickly determine what "crt" does.
-- 
Regards,
Paul Clarke

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV