* [PATCH] platform/chrome: fix memory corruption in ioctl
@ 2022-08-19 5:20 Dan Carpenter
2022-08-19 10:47 ` Guenter Roeck
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Dan Carpenter @ 2022-08-19 5:20 UTC (permalink / raw)
To: Benson Leung, Enric Balletbo i Serra
Cc: Guenter Roeck, Andy Shevchenko, Lee Jones, Gwendal Grignou,
chrome-platform, kernel-janitors
If "s_mem.bytes" is larger than the buffer size it leads to memory
corruption.
Fixes: eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/platform/chrome/cros_ec_chardev.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/platform/chrome/cros_ec_chardev.c b/drivers/platform/chrome/cros_ec_chardev.c
index fd33de546aee..2442dce4e208 100644
--- a/drivers/platform/chrome/cros_ec_chardev.c
+++ b/drivers/platform/chrome/cros_ec_chardev.c
@@ -327,6 +327,9 @@ static long cros_ec_chardev_ioctl_readmem(struct cros_ec_dev *ec,
if (copy_from_user(&s_mem, arg, sizeof(s_mem)))
return -EFAULT;
+ if (s_mem.bytes > sizeof(s_mem.buffer))
+ return -EINVAL;
+
num = ec_dev->cmd_readmem(ec_dev, s_mem.offset, s_mem.bytes,
s_mem.buffer);
if (num <= 0)
--
2.35.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] platform/chrome: fix memory corruption in ioctl
2022-08-19 5:20 [PATCH] platform/chrome: fix memory corruption in ioctl Dan Carpenter
@ 2022-08-19 10:47 ` Guenter Roeck
2022-08-22 7:00 ` patchwork-bot+chrome-platform
2022-08-24 2:20 ` patchwork-bot+chrome-platform
2 siblings, 0 replies; 4+ messages in thread
From: Guenter Roeck @ 2022-08-19 10:47 UTC (permalink / raw)
To: Dan Carpenter
Cc: Benson Leung, Enric Balletbo i Serra, Guenter Roeck,
Andy Shevchenko, Lee Jones, Gwendal Grignou,
open list:CHROME HARDWARE PLATFORM SUPPORT, kernel-janitors
On Thu, Aug 18, 2022 at 10:20 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> If "s_mem.bytes" is larger than the buffer size it leads to memory
> corruption.
>
> Fixes: eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
> ---
> drivers/platform/chrome/cros_ec_chardev.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/platform/chrome/cros_ec_chardev.c b/drivers/platform/chrome/cros_ec_chardev.c
> index fd33de546aee..2442dce4e208 100644
> --- a/drivers/platform/chrome/cros_ec_chardev.c
> +++ b/drivers/platform/chrome/cros_ec_chardev.c
> @@ -327,6 +327,9 @@ static long cros_ec_chardev_ioctl_readmem(struct cros_ec_dev *ec,
> if (copy_from_user(&s_mem, arg, sizeof(s_mem)))
> return -EFAULT;
>
> + if (s_mem.bytes > sizeof(s_mem.buffer))
> + return -EINVAL;
> +
> num = ec_dev->cmd_readmem(ec_dev, s_mem.offset, s_mem.bytes,
> s_mem.buffer);
> if (num <= 0)
> --
> 2.35.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] platform/chrome: fix memory corruption in ioctl
2022-08-19 5:20 [PATCH] platform/chrome: fix memory corruption in ioctl Dan Carpenter
2022-08-19 10:47 ` Guenter Roeck
@ 2022-08-22 7:00 ` patchwork-bot+chrome-platform
2022-08-24 2:20 ` patchwork-bot+chrome-platform
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+chrome-platform @ 2022-08-22 7:00 UTC (permalink / raw)
To: Dan Carpenter
Cc: bleung, enric.balletbo, groeck, andriy.shevchenko, lee.jones,
gwendal, chrome-platform, kernel-janitors
Hello:
This patch was applied to chrome-platform/linux.git (for-kernelci)
by Tzung-Bi Shih <tzungbi@kernel.org>:
On Fri, 19 Aug 2022 08:20:36 +0300 you wrote:
> If "s_mem.bytes" is larger than the buffer size it leads to memory
> corruption.
>
> Fixes: eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/platform/chrome/cros_ec_chardev.c | 3 +++
> 1 file changed, 3 insertions(+)
Here is the summary with links:
- platform/chrome: fix memory corruption in ioctl
https://git.kernel.org/chrome-platform/c/8a07b45fd3c2
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] platform/chrome: fix memory corruption in ioctl
2022-08-19 5:20 [PATCH] platform/chrome: fix memory corruption in ioctl Dan Carpenter
2022-08-19 10:47 ` Guenter Roeck
2022-08-22 7:00 ` patchwork-bot+chrome-platform
@ 2022-08-24 2:20 ` patchwork-bot+chrome-platform
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+chrome-platform @ 2022-08-24 2:20 UTC (permalink / raw)
To: Dan Carpenter
Cc: bleung, enric.balletbo, groeck, andriy.shevchenko, lee.jones,
gwendal, chrome-platform, kernel-janitors
Hello:
This patch was applied to chrome-platform/linux.git (for-next)
by Tzung-Bi Shih <tzungbi@kernel.org>:
On Fri, 19 Aug 2022 08:20:36 +0300 you wrote:
> If "s_mem.bytes" is larger than the buffer size it leads to memory
> corruption.
>
> Fixes: eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/platform/chrome/cros_ec_chardev.c | 3 +++
> 1 file changed, 3 insertions(+)
Here is the summary with links:
- platform/chrome: fix memory corruption in ioctl
https://git.kernel.org/chrome-platform/c/8a07b45fd3c2
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-08-24 2:20 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-08-19 5:20 [PATCH] platform/chrome: fix memory corruption in ioctl Dan Carpenter
2022-08-19 10:47 ` Guenter Roeck
2022-08-22 7:00 ` patchwork-bot+chrome-platform
2022-08-24 2:20 ` patchwork-bot+chrome-platform
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox