From 09c24f76dce5f606056d916207676f2a93157deb Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 5 Apr 2022 10:17:22 +0200
Subject: [PATCH 1/3] sd-device: simplify
 device_enumerator_scan_devices_and_subsystems() a bit

We can use enumerator_scan_devices_all() to shorten the code, and drop
some of the error handling complexities.
---
 src/libsystemd/sd-device/device-enumerator.c | 31 +++++++++-----------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/src/libsystemd/sd-device/device-enumerator.c b/src/libsystemd/sd-device/device-enumerator.c
index 14794fb3af5..61645f44d81 100644
--- a/src/libsystemd/sd-device/device-enumerator.c
+++ b/src/libsystemd/sd-device/device-enumerator.c
@@ -638,7 +638,12 @@ static bool match_subsystem(sd_device_enumerator *enumerator, const char *subsys
         return false;
 }
 
-static int enumerator_scan_dir(sd_device_enumerator *enumerator, const char *basedir, const char *subdir, const char *subsystem) {
+static int enumerator_scan_dir(
+                sd_device_enumerator *enumerator,
+                const char *basedir,
+                const char *subdir,
+                const char *subsystem) {
+
         _cleanup_closedir_ DIR *dir = NULL;
         char *path;
         int r = 0;
@@ -997,7 +1002,7 @@ _public_ sd_device *sd_device_enumerator_get_subsystem_next(sd_device_enumerator
 }
 
 int device_enumerator_scan_devices_and_subsystems(sd_device_enumerator *enumerator) {
-        int r = 0, k;
+        int r;
 
         assert(enumerator);
 
@@ -1007,22 +1012,14 @@ int device_enumerator_scan_devices_and_subsystems(sd_device_enumerator *enumerat
 
         device_enumerator_unref_devices(enumerator);
 
-        if (!set_isempty(enumerator->match_tag)) {
-                k = enumerator_scan_devices_tags(enumerator);
-                if (k < 0)
-                        r = k;
-        } else if (enumerator->match_parent) {
-                k = enumerator_scan_devices_children(enumerator);
-                if (k < 0)
-                        r = k;
-        } else {
-                k = enumerator_scan_dir(enumerator, "class", NULL, NULL);
-                if (k < 0)
-                        r = log_debug_errno(k, "sd-device-enumerator: Failed to scan /sys/class: %m");
+        if (!set_isempty(enumerator->match_tag))
+                r = enumerator_scan_devices_tags(enumerator);
+        else if (enumerator->match_parent)
+                r = enumerator_scan_devices_children(enumerator);
+        else {
+                int k;
 
-                k = enumerator_scan_dir(enumerator, "bus", "devices", NULL);
-                if (k < 0)
-                        r = log_debug_errno(k, "sd-device-enumerator: Failed to scan /sys/bus: %m");
+                r = enumerator_scan_devices_all(enumerator);
 
                 if (match_subsystem(enumerator, "module")) {
                         k = enumerator_scan_dir_and_add_devices(enumerator, "module", NULL, NULL);

From 4d960d0bdb373b6bb71f77f8a3032795d60284c3 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 5 Apr 2022 10:18:17 +0200
Subject: [PATCH 2/3] sd-device: make device_set_syspath() more defensive

Simplify generated sysfs paths, since we might get data passed that
includes extra // in the middle.

Also, let's not assume /sys/ prefix without verification.
---
 src/libsystemd/sd-device/sd-device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/libsystemd/sd-device/sd-device.c b/src/libsystemd/sd-device/sd-device.c
index 89c5b2cdd36..f9c491c242b 100644
--- a/src/libsystemd/sd-device/sd-device.c
+++ b/src/libsystemd/sd-device/sd-device.c
@@ -207,10 +207,11 @@ int device_set_syspath(sd_device *device, const char *_syspath, bool verify) {
                 syspath = strdup(_syspath);
                 if (!syspath)
                         return log_oom_debug();
+
+                path_simplify(syspath);
         }
 
-        devpath = syspath + STRLEN("/sys");
-
+        assert_se(devpath = startswith(syspath, "/sys"));
         if (devpath[0] != '/')
                 return log_debug_errno(SYNTHETIC_ERRNO(ENODEV), "sd-device: \"/sys\" alone is not a valid device path.");
 

From 9d41c62f6eeb50334e155e1f788e132d55d0c8c1 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 5 Apr 2022 10:19:20 +0200
Subject: [PATCH 3/3] sd-device: validate devnum parameters in
 device_set_devnum()

---
 src/libsystemd/sd-device/sd-device.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/libsystemd/sd-device/sd-device.c b/src/libsystemd/sd-device/sd-device.c
index f9c491c242b..d31526fc222 100644
--- a/src/libsystemd/sd-device/sd-device.c
+++ b/src/libsystemd/sd-device/sd-device.c
@@ -585,11 +585,15 @@ int device_set_devnum(sd_device *device, const char *major, const char *minor) {
                 return r;
         if (maj == 0)
                 return 0;
+        if (!DEVICE_MAJOR_VALID(maj))
+                return -EINVAL;
 
         if (minor) {
                 r = safe_atou(minor, &min);
                 if (r < 0)
                         return r;
+                if (!DEVICE_MINOR_VALID(min))
+                        return -EINVAL;
         }
 
         r = device_add_property_internal(device, "MAJOR", major);