From: David Laight <david.laight.linux@gmail•com>
To: Kees Cook <kees@kernel•org>
Cc: "Luis Chamberlain" <mcgrof@kernel•org>,
"Pengpeng Hou" <pengpeng@iscas•ac.cn>,
stable@vger•kernel.org, "Petr Pavlu" <petr.pavlu@suse•com>,
"Richard Weinberger" <richard@nod•at>,
"Anton Ivanov" <anton.ivanov@cambridgegreys•com>,
"Johannes Berg" <johannes@sipsolutions•net>,
"Rafael J. Wysocki" <rafael@kernel•org>,
"Len Brown" <lenb@kernel•org>,
"Corey Minyard" <corey@minyard•net>,
"Gabriel Somlo" <somlo@cmu•edu>,
"Michael S. Tsirkin" <mst@redhat•com>,
"Jani Nikula" <jani.nikula@linux•intel.com>,
"Joonas Lahtinen" <joonas.lahtinen@linux•intel.com>,
"Rodrigo Vivi" <rodrigo.vivi@intel•com>,
"Tvrtko Ursulin" <tursulin@ursulin•net>,
"David Airlie" <airlied@gmail•com>,
"Simona Vetter" <simona@ffwll•ch>,
"Bart Van Assche" <bvanassche@acm•org>,
"Jason Gunthorpe" <jgg@ziepe•ca>,
"Leon Romanovsky" <leon@kernel•org>,
"Laurent Pinchart" <laurent.pinchart@ideasonboard•com>,
"Hans de Goede" <hansg@kernel•org>,
"Mauro Carvalho Chehab" <mchehab@kernel•org>,
"Bjorn Helgaas" <bhelgaas@google•com>,
"Hannes Reinecke" <hare@suse•de>,
"James E.J. Bottomley" <James.Bottomley@HansenPartnership•com>,
"Martin K. Petersen" <martin.petersen@oracle•com>,
"Daniel Lezcano" <daniel.lezcano@kernel•org>,
"Zhang Rui" <rui.zhang@intel•com>,
"Lukasz Luba" <lukasz.luba@arm•com>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation•org>,
"Jiri Slaby" <jirislaby@kernel•org>,
"Alan Stern" <stern@rowland•harvard.edu>,
"Jason Wang" <jasowang@redhat•com>,
"Xuan Zhuo" <xuanzhuo@linux•alibaba.com>,
"Eugenio Pérez" <eperezma@redhat•com>,
"Jason Baron" <jbaron@akamai•com>,
"Jim Cromie" <jim.cromie@gmail•com>,
"Tiwei Bie" <tiwei.btw@antgroup•com>,
"Benjamin Berg" <benjamin.berg@intel•com>,
"Ilpo Järvinen" <ilpo.jarvinen@linux•intel.com>,
"David E. Box" <david.e.box@linux•intel.com>,
"Maciej W. Rozycki" <macro@orcam•me.uk>,
"Srinivas Pandruvada" <srinivas.pandruvada@linux•intel.com>,
"Peter Zijlstra" <peterz@infradead•org>,
"Heiko Carstens" <hca@linux•ibm.com>,
"Vasily Gorbik" <gor@linux•ibm.com>,
"Sean Christopherson" <seanjc@google•com>,
"Paolo Bonzini" <pbonzini@redhat•com>,
"Thomas Gleixner" <tglx@kernel•org>,
"Ingo Molnar" <mingo@redhat•com>,
"Borislav Petkov" <bp@alien8•de>,
"Dave Hansen" <dave.hansen@linux•intel.com>,
x86@kernel•org, "H. Peter Anvin" <hpa@zytor•com>,
"Vinod Koul" <vkoul@kernel•org>, "Frank Li" <Frank.Li@kernel•org>,
"Daniel Gomez" <da.gomez@kernel•org>,
"Sami Tolvanen" <samitolvanen@google•com>,
"Aaron Tomlin" <atomlin@atomlin•com>,
"Alexander Potapenko" <glider@google•com>,
"Marco Elver" <elver@google•com>,
"Dmitry Vyukov" <dvyukov@google•com>,
"Andrew Morton" <akpm@linux-foundation•org>,
"John Johansen" <john.johansen@canonical•com>,
"Paul Moore" <paul@paul-moore•com>,
"James Morris" <jmorris@namei•org>,
"Serge E. Hallyn" <serge@hallyn•com>,
"Andy Shevchenko" <andriy.shevchenko@linux•intel.com>,
"Georgia Garcia" <georgia.garcia@canonical•com>,
kvm@vger•kernel.org, dmaengine@vger•kernel.org,
linux-modules@vger•kernel.org, kasan-dev@googlegroups•com,
linux-mm@kvack•org, apparmor@lists•ubuntu.com,
linux-security-module@vger•kernel.org,
linux-um@lists•infradead.org, linux-acpi@vger•kernel.org,
openipmi-developer@lists•sourceforge.net, qemu-devel@nongnu•org,
intel-gfx@lists•freedesktop.org, dri-devel@lists•freedesktop.org,
linux-rdma@vger•kernel.org, linux-media@vger•kernel.org,
linux-pci@vger•kernel.org, linux-scsi@vger•kernel.org,
linux-pm@vger•kernel.org, linuxppc-dev@lists•ozlabs.org,
linux-serial@vger•kernel.org, linux-usb@vger•kernel.org,
usb-storage@lists•one-eyed-alien.net,
virtualization@lists•linux.dev, linux-kernel@vger•kernel.org,
linux-arch@vger•kernel.org, netdev@vger•kernel.org,
linux-fsdevel@vger•kernel.org, linux-hardening@vger•kernel.org
Subject: Re: [PATCH 01/11] params: bound array element output to the caller's page buffer
Date: Thu, 21 May 2026 17:46:31 +0100 [thread overview]
Message-ID: <20260521174631.71a06440@pumpkin> (raw)
In-Reply-To: <20260521133326.2465264-1-kees@kernel.org>
On Thu, 21 May 2026 06:33:14 -0700
Kees Cook <kees@kernel•org> wrote:
> From: Pengpeng Hou <pengpeng@iscas•ac.cn>
>
> param_array_get() appends each element's string representation into the
> shared sysfs page buffer by passing buffer + off to the element getter.
>
> That works for getters that only write a small bounded string, but
> param_get_charp() and similar helpers format against PAGE_SIZE from the
> pointer they receive. Once off is non-zero, an element getter can
> therefore write past the end of the original sysfs page buffer.
>
> Collect each element into a temporary PAGE_SIZE buffer first and then
> copy only the remaining space into the caller's page buffer.
Should this be using a 4k buffer on all architectures?
Initially perhaps just using a different name for the constant until
all the associated PAGE_SIZE limits have been removed.
-- David
>
> Cc: stable@vger•kernel.org
> Reviewed-by: Petr Pavlu <petr.pavlu@suse•com>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas•ac.cn>
> Signed-off-by: Kees Cook <kees@kernel•org>
> ---
> kernel/params.c | 26 ++++++++++++++++++++------
> 1 file changed, 20 insertions(+), 6 deletions(-)
>
> diff --git a/kernel/params.c b/kernel/params.c
> index 74d620bc2521..752721922a15 100644
> --- a/kernel/params.c
> +++ b/kernel/params.c
> @@ -475,22 +475,36 @@ static int param_array_set(const char *val, const struct kernel_param *kp)
> static int param_array_get(char *buffer, const struct kernel_param *kp)
> {
> int i, off, ret;
> + char *elem_buf;
> const struct kparam_array *arr = kp->arr;
> struct kernel_param p = *kp;
>
> + elem_buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
> + if (!elem_buf)
> + return -ENOMEM;
> +
> for (i = off = 0; i < (arr->num ? *arr->num : arr->max); i++) {
> - /* Replace \n with comma */
> - if (i)
> - buffer[off - 1] = ',';
> p.arg = arr->elem + arr->elemsize * i;
> check_kparam_locked(p.mod);
> - ret = arr->ops->get(buffer + off, &p);
> + ret = arr->ops->get(elem_buf, &p);
> if (ret < 0)
> - return ret;
> + goto out;
> + ret = min(ret, (int)(PAGE_SIZE - 1 - off));
> + if (!ret)
> + break;
> + /* Replace the previous element's trailing newline with a comma. */
> + if (i)
> + buffer[off - 1] = ',';
> + memcpy(buffer + off, elem_buf, ret);
> off += ret;
> + if (off == PAGE_SIZE - 1)
> + break;
> }
> buffer[off] = '\0';
> - return off;
> + ret = off;
> +out:
> + kfree(elem_buf);
> + return ret;
> }
>
> static void param_array_free(void *arg)
next prev parent reply other threads:[~2026-05-21 16:46 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-21 13:33 [PATCH 00/11] Convert moduleparams to seq_buf Kees Cook
2026-05-21 13:33 ` [PATCH 01/11] params: bound array element output to the caller's page buffer Kees Cook
2026-05-21 16:46 ` David Laight [this message]
2026-06-01 20:23 ` Matthew Wilcox
2026-06-02 11:26 ` Andy Shevchenko
2026-06-02 12:33 ` Jason Gunthorpe
2026-06-02 13:04 ` David Laight
2026-05-21 13:33 ` [PATCH 02/11] panic: Replace panic_print_get() with generic helper Kees Cook
2026-05-21 13:33 ` [PATCH 03/11] moduleparam: Add DEFINE_KERNEL_PARAM_OPS macro family Kees Cook
2026-05-25 13:27 ` Petr Pavlu
2026-05-21 13:33 ` [PATCH 04/11] treewide: Convert struct kernel_param_ops initializers to DEFINE_KERNEL_PARAM_OPS Kees Cook
2026-05-21 13:59 ` Sean Christopherson
2026-05-22 17:01 ` Rafael J. Wysocki
2026-05-23 0:38 ` SeongJae Park
2026-05-25 13:35 ` Petr Pavlu
2026-05-21 13:33 ` [PATCH 05/11] moduleparam: Rename .get field to .get_str Kees Cook
2026-05-21 13:33 ` [PATCH 06/11] moduleparam: Add seq_buf-based .get callback alongside .get_str Kees Cook
2026-05-25 16:19 ` Petr Pavlu
2026-05-21 13:33 ` [PATCH 07/11] moduleparam: Route DEFINE_KERNEL_PARAM_OPS get pointer via _Generic Kees Cook
2026-05-25 16:24 ` Petr Pavlu
2026-05-21 13:33 ` [PATCH 08/11] params: Convert generic kernel_param_ops .get helpers to seq_buf Kees Cook
2026-05-25 17:10 ` Petr Pavlu
2026-05-21 13:33 ` [PATCH 09/11] treewide: Convert custom kernel_param_ops .get callbacks to seq_buf via cocci Kees Cook
2026-05-21 13:45 ` Sean Christopherson
2026-05-22 17:03 ` Rafael J. Wysocki
2026-05-23 0:45 ` SeongJae Park
2026-05-21 13:33 ` [PATCH 10/11] treewide: Manually convert custom kernel_param_ops .get callbacks Kees Cook
2026-05-21 17:44 ` Jani Nikula
2026-05-22 17:05 ` Rafael J. Wysocki
2026-05-21 13:33 ` [PATCH 11/11] moduleparam: Drop legacy kernel_param_ops .get_str field and dispatch logic Kees Cook
2026-05-26 6:53 ` [PATCH 00/11] Convert moduleparams to seq_buf Petr Pavlu
2026-06-01 19:59 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260521174631.71a06440@pumpkin \
--to=david.laight.linux@gmail$(echo .)com \
--cc=Frank.Li@kernel$(echo .)org \
--cc=James.Bottomley@HansenPartnership$(echo .)com \
--cc=airlied@gmail$(echo .)com \
--cc=akpm@linux-foundation$(echo .)org \
--cc=andriy.shevchenko@linux$(echo .)intel.com \
--cc=anton.ivanov@cambridgegreys$(echo .)com \
--cc=apparmor@lists$(echo .)ubuntu.com \
--cc=atomlin@atomlin$(echo .)com \
--cc=benjamin.berg@intel$(echo .)com \
--cc=bhelgaas@google$(echo .)com \
--cc=bp@alien8$(echo .)de \
--cc=bvanassche@acm$(echo .)org \
--cc=corey@minyard$(echo .)net \
--cc=da.gomez@kernel$(echo .)org \
--cc=daniel.lezcano@kernel$(echo .)org \
--cc=dave.hansen@linux$(echo .)intel.com \
--cc=david.e.box@linux$(echo .)intel.com \
--cc=dmaengine@vger$(echo .)kernel.org \
--cc=dri-devel@lists$(echo .)freedesktop.org \
--cc=dvyukov@google$(echo .)com \
--cc=elver@google$(echo .)com \
--cc=eperezma@redhat$(echo .)com \
--cc=georgia.garcia@canonical$(echo .)com \
--cc=glider@google$(echo .)com \
--cc=gor@linux$(echo .)ibm.com \
--cc=gregkh@linuxfoundation$(echo .)org \
--cc=hansg@kernel$(echo .)org \
--cc=hare@suse$(echo .)de \
--cc=hca@linux$(echo .)ibm.com \
--cc=hpa@zytor$(echo .)com \
--cc=ilpo.jarvinen@linux$(echo .)intel.com \
--cc=intel-gfx@lists$(echo .)freedesktop.org \
--cc=jani.nikula@linux$(echo .)intel.com \
--cc=jasowang@redhat$(echo .)com \
--cc=jbaron@akamai$(echo .)com \
--cc=jgg@ziepe$(echo .)ca \
--cc=jim.cromie@gmail$(echo .)com \
--cc=jirislaby@kernel$(echo .)org \
--cc=jmorris@namei$(echo .)org \
--cc=johannes@sipsolutions$(echo .)net \
--cc=john.johansen@canonical$(echo .)com \
--cc=joonas.lahtinen@linux$(echo .)intel.com \
--cc=kasan-dev@googlegroups$(echo .)com \
--cc=kees@kernel$(echo .)org \
--cc=kvm@vger$(echo .)kernel.org \
--cc=laurent.pinchart@ideasonboard$(echo .)com \
--cc=lenb@kernel$(echo .)org \
--cc=leon@kernel$(echo .)org \
--cc=linux-acpi@vger$(echo .)kernel.org \
--cc=linux-arch@vger$(echo .)kernel.org \
--cc=linux-fsdevel@vger$(echo .)kernel.org \
--cc=linux-hardening@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-media@vger$(echo .)kernel.org \
--cc=linux-mm@kvack$(echo .)org \
--cc=linux-modules@vger$(echo .)kernel.org \
--cc=linux-pci@vger$(echo .)kernel.org \
--cc=linux-pm@vger$(echo .)kernel.org \
--cc=linux-rdma@vger$(echo .)kernel.org \
--cc=linux-scsi@vger$(echo .)kernel.org \
--cc=linux-security-module@vger$(echo .)kernel.org \
--cc=linux-serial@vger$(echo .)kernel.org \
--cc=linux-um@lists$(echo .)infradead.org \
--cc=linux-usb@vger$(echo .)kernel.org \
--cc=linuxppc-dev@lists$(echo .)ozlabs.org \
--cc=lukasz.luba@arm$(echo .)com \
--cc=macro@orcam$(echo .)me.uk \
--cc=martin.petersen@oracle$(echo .)com \
--cc=mcgrof@kernel$(echo .)org \
--cc=mchehab@kernel$(echo .)org \
--cc=mingo@redhat$(echo .)com \
--cc=mst@redhat$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=openipmi-developer@lists$(echo .)sourceforge.net \
--cc=paul@paul-moore$(echo .)com \
--cc=pbonzini@redhat$(echo .)com \
--cc=pengpeng@iscas$(echo .)ac.cn \
--cc=peterz@infradead$(echo .)org \
--cc=petr.pavlu@suse$(echo .)com \
--cc=qemu-devel@nongnu$(echo .)org \
--cc=rafael@kernel$(echo .)org \
--cc=richard@nod$(echo .)at \
--cc=rodrigo.vivi@intel$(echo .)com \
--cc=rui.zhang@intel$(echo .)com \
--cc=samitolvanen@google$(echo .)com \
--cc=seanjc@google$(echo .)com \
--cc=serge@hallyn$(echo .)com \
--cc=simona@ffwll$(echo .)ch \
--cc=somlo@cmu$(echo .)edu \
--cc=srinivas.pandruvada@linux$(echo .)intel.com \
--cc=stable@vger$(echo .)kernel.org \
--cc=stern@rowland$(echo .)harvard.edu \
--cc=tglx@kernel$(echo .)org \
--cc=tiwei.btw@antgroup$(echo .)com \
--cc=tursulin@ursulin$(echo .)net \
--cc=usb-storage@lists$(echo .)one-eyed-alien.net \
--cc=virtualization@lists$(echo .)linux.dev \
--cc=vkoul@kernel$(echo .)org \
--cc=x86@kernel$(echo .)org \
--cc=xuanzhuo@linux$(echo .)alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox