RE: [PATCH 3/3] powerpc/fsl: add MPIC timer wakeup support

-----Original Message-----
From: Wood Scott-B07421
Sent: Saturday, March 23, 2013 6:11 AM
To: Wang Dongsheng-B40534
Cc: Wood Scott-B07421; Gala Kumar-B11780; linuxppc-dev@lists.ozlabs.org;
Zhao Chenhui-B35336; Li Yang-R58472
Subject: Re: [PATCH 3/3] powerpc/fsl: add MPIC timer wakeup support
=20
On 03/22/2013 12:46:24 AM, Wang Dongsheng-B40534 wrote:

quoted

quoted

-----Original Message-----
From: Wood Scott-B07421
Sent: Thursday, March 21, 2013 5:49 AM
To: Wang Dongsheng-B40534
Cc: Wood Scott-B07421; Gala Kumar-B11780;

linuxppc-dev@lists.ozlabs.org;

quoted

Zhao Chenhui-B35336; Li Yang-R58472
Subject: Re: [PATCH 3/3] powerpc/fsl: add MPIC timer wakeup support

On 03/19/2013 10:48:53 PM, Wang Dongsheng-B40534 wrote:

quoted

	while (*s) {
		if ('0' <=3D *s && *s <=3D '9')
			val =3D *s - '0';
		else if ('a' <=3D _tolower(*s) && _tolower(*s) <=3D 'f')
			val =3D _tolower(*s) - 'a' + 10;
		else
			break;	//this will break out to convert.

Really?  How do you know that the next byte after the buffer isn't a
valid hex digit?  How do you even know that we won't take a fault
accessing it?

Under what case is unsafe, please make sense.

=20
char buffer[1] =3D { '5' };
write(fd, &buffer, 1);
=20
What comes after that '5' byte in the pointer you pass to kstrtol?
=20

The buffer is userspace. It will fall in the kernel space.
Kernel will get a free page, and copy the buffer to page.
This page has been cleared before copy to page.
The page has already have null-terminated.

quoted

"kstrtol" is used in almost of sysfs interface, I think it should be
accepted in defaule :).

=20
Just because a lot of other people copy blindly doesn't make it right.
Most of the examples I found use sscanf instead, though that has the same
problem.
=20
I do see a few instances of the "strings from sysfs write are not 0
terminated!" in the comments, though (kernel/time/clocksource.c and
kernel/rtmutex-tester.c).
=20
Also "words written to sysfs files may, or may not, be \n terminated"
in drivers/md/md.c.
=20

It's not "kstrtol" doesn't work as well, They do not belong to this kind
of scenarios.