Re: [tip:x86/cpu] x86/cpu: Strip any /proc/ cpuinfo model name field whitespace

[Borislav Petkov]

On Wed, May 27, 2015 at 10:07:34AM -0700, Joe Perches wrote:
> This code can memmove from beyond the x86_model_id field.

... in the theoretical case where some model ID has more than 64 - 48
preceding white spaces.

I guess we want to be prepared here for insane CPU model IDs coming from
virtualization.

> Maybe:
> 	char *model = strim(c->x86_model_id);
> 	memmove(c->x86_model_id, model, strlen(model) + 1);

Yes, and additionally limit that string length:

---
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index b35c777df6df..9d1fd48486d6 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -383,6 +383,9 @@ static const struct cpu_dev *cpu_devs[X86_VENDOR_NUM] = {};
 static void get_model_name(struct cpuinfo_x86 *c)
 {
 	unsigned int *v;
+	const char *model;
+
+#define MODEL_ID_MAXLEN 48
 
 	if (c->extended_cpuid_level < 0x80000004)
 		return;
@@ -391,13 +394,15 @@ static void get_model_name(struct cpuinfo_x86 *c)
 	cpuid(0x80000002, &v[0], &v[1], &v[2], &v[3]);
 	cpuid(0x80000003, &v[4], &v[5], &v[6], &v[7]);
 	cpuid(0x80000004, &v[8], &v[9], &v[10], &v[11]);
-	c->x86_model_id[48] = 0;
+	c->x86_model_id[MODEL_ID_MAXLEN] = 0;
 
 	/*
 	 * Remove leading whitespace on Intel processors and trailing
 	 * whitespace on AMD processors.
 	 */
-	memmove(c->x86_model_id, strim(c->x86_model_id), 48);
+	model = strim(c->x86_model_id);
+
+	memmove(c->x86_model_id, model, strnlen(model, MODEL_ID_MAXLEN) + 1);
 }
 
 void cpu_detect_cache_sizes(struct cpuinfo_x86 *c)

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/