* [patch] max17042_battery: fix a couple buffer overflows
@ 2012-03-15 11:37 Dan Carpenter
2012-03-15 16:57 ` Dirk Brandewie
2012-03-15 17:20 ` Dirk Brandewie
0 siblings, 2 replies; 4+ messages in thread
From: Dan Carpenter @ 2012-03-15 11:37 UTC (permalink / raw)
To: Grant Likely, Dirk Brandewie
Cc: Rob Herring, Anton Vorontsov, MyungJoo Ham, Kyungmin Park,
Philip Rakity, linux-kernel, devicetree-discuss, kernel-janitors
There are a couple issues here caused by confusion between sizeof()
and ARRAY_SIZE(). "table_size" should be the number of elements, but we
should allocate it with kcalloc() so that we allocate the correct number
of bytes.
In max17042_init_model() we don't allocate enough space so we go past
the end of the array in max17042_read_model_data() and
max17042_model_data_compare().
In max17042_verify_model_lock() we allocate the right amount of space
but we call max17042_read_model_data() with the wrong number of elements
and also in the for loop we go past the end of the array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I don't have this hardware. The original code is clearly buggy, but I
can't test that my fix is correct. Please review carefully.
diff --git a/drivers/power/max17042_battery.c b/drivers/power/max17042_battery.c
index e36763a..f8cd48c 100644
--- a/drivers/power/max17042_battery.c
+++ b/drivers/power/max17042_battery.c
@@ -328,11 +328,10 @@ static inline int max17042_model_data_compare(struct max17042_chip *chip,
static int max17042_init_model(struct max17042_chip *chip)
{
int ret;
- int table_size =
- sizeof(chip->pdata->config_data->cell_char_tbl)/sizeof(u16);
+ int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
u16 *temp_data;
- temp_data = kzalloc(table_size, GFP_KERNEL);
+ temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
if (!temp_data)
return -ENOMEM;
@@ -357,12 +356,11 @@ static int max17042_init_model(struct max17042_chip *chip)
static int max17042_verify_model_lock(struct max17042_chip *chip)
{
int i;
- int table_size =
- sizeof(chip->pdata->config_data->cell_char_tbl);
+ int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
u16 *temp_data;
int ret = 0;
- temp_data = kzalloc(table_size, GFP_KERNEL);
+ temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
if (!temp_data)
return -ENOMEM;
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [patch] max17042_battery: fix a couple buffer overflows
2012-03-15 11:37 [patch] max17042_battery: fix a couple buffer overflows Dan Carpenter
@ 2012-03-15 16:57 ` Dirk Brandewie
2012-03-15 17:20 ` Dirk Brandewie
1 sibling, 0 replies; 4+ messages in thread
From: Dirk Brandewie @ 2012-03-15 16:57 UTC (permalink / raw)
To: Dan Carpenter
Cc: Grant Likely, Dirk Brandewie, Rob Herring, Anton Vorontsov,
MyungJoo Ham, Kyungmin Park, Philip Rakity, linux-kernel,
devicetree-discuss, kernel-janitors
On 03/15/2012 04:37 AM, Dan Carpenter wrote:
> There are a couple issues here caused by confusion between sizeof()
> and ARRAY_SIZE(). "table_size" should be the number of elements, but we
> should allocate it with kcalloc() so that we allocate the correct number
> of bytes.
>
> In max17042_init_model() we don't allocate enough space so we go past
> the end of the array in max17042_read_model_data() and
> max17042_model_data_compare().
>
> In max17042_verify_model_lock() we allocate the right amount of space
> but we call max17042_read_model_data() with the wrong number of elements
> and also in the for loop we go past the end of the array.
>
> Signed-off-by: Dan Carpenter<dan.carpenter@oracle.com>
Acked-by: Dirk Brandewie <dirk.brandewie@intel.com>
> ---
> I don't have this hardware. The original code is clearly buggy, but I
> can't test that my fix is correct. Please review carefully.
>
> diff --git a/drivers/power/max17042_battery.c b/drivers/power/max17042_battery.c
> index e36763a..f8cd48c 100644
> --- a/drivers/power/max17042_battery.c
> +++ b/drivers/power/max17042_battery.c
> @@ -328,11 +328,10 @@ static inline int max17042_model_data_compare(struct max17042_chip *chip,
> static int max17042_init_model(struct max17042_chip *chip)
> {
> int ret;
> - int table_size =
> - sizeof(chip->pdata->config_data->cell_char_tbl)/sizeof(u16);
> + int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
> u16 *temp_data;
>
> - temp_data = kzalloc(table_size, GFP_KERNEL);
> + temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
> if (!temp_data)
> return -ENOMEM;
>
> @@ -357,12 +356,11 @@ static int max17042_init_model(struct max17042_chip *chip)
> static int max17042_verify_model_lock(struct max17042_chip *chip)
> {
> int i;
> - int table_size =
> - sizeof(chip->pdata->config_data->cell_char_tbl);
> + int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
> u16 *temp_data;
> int ret = 0;
>
> - temp_data = kzalloc(table_size, GFP_KERNEL);
> + temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
> if (!temp_data)
> return -ENOMEM;
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [patch] max17042_battery: fix a couple buffer overflows
2012-03-15 11:37 [patch] max17042_battery: fix a couple buffer overflows Dan Carpenter
2012-03-15 16:57 ` Dirk Brandewie
@ 2012-03-15 17:20 ` Dirk Brandewie
2012-05-05 2:26 ` Anton Vorontsov
1 sibling, 1 reply; 4+ messages in thread
From: Dirk Brandewie @ 2012-03-15 17:20 UTC (permalink / raw)
To: Dan Carpenter
Cc: Grant Likely, Dirk Brandewie, Rob Herring, Anton Vorontsov,
MyungJoo Ham, Kyungmin Park, Philip Rakity, linux-kernel,
devicetree-discuss, kernel-janitors
On 03/15/2012 04:37 AM, Dan Carpenter wrote:
> There are a couple issues here caused by confusion between sizeof()
> and ARRAY_SIZE(). "table_size" should be the number of elements, but we
> should allocate it with kcalloc() so that we allocate the correct number
> of bytes.
>
> In max17042_init_model() we don't allocate enough space so we go past
> the end of the array in max17042_read_model_data() and
> max17042_model_data_compare().
>
> In max17042_verify_model_lock() we allocate the right amount of space
> but we call max17042_read_model_data() with the wrong number of elements
> and also in the for loop we go past the end of the array.
>
> Signed-off-by: Dan Carpenter<dan.carpenter@oracle.com>
Acked-by: Dirk Brandewie <dirk.brandewie@gmail.com>
Typo in first ack :-(
> ---
> I don't have this hardware. The original code is clearly buggy, but I
> can't test that my fix is correct. Please review carefully.
>
> diff --git a/drivers/power/max17042_battery.c b/drivers/power/max17042_battery.c
> index e36763a..f8cd48c 100644
> --- a/drivers/power/max17042_battery.c
> +++ b/drivers/power/max17042_battery.c
> @@ -328,11 +328,10 @@ static inline int max17042_model_data_compare(struct max17042_chip *chip,
> static int max17042_init_model(struct max17042_chip *chip)
> {
> int ret;
> - int table_size =
> - sizeof(chip->pdata->config_data->cell_char_tbl)/sizeof(u16);
> + int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
> u16 *temp_data;
>
> - temp_data = kzalloc(table_size, GFP_KERNEL);
> + temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
> if (!temp_data)
> return -ENOMEM;
>
> @@ -357,12 +356,11 @@ static int max17042_init_model(struct max17042_chip *chip)
> static int max17042_verify_model_lock(struct max17042_chip *chip)
> {
> int i;
> - int table_size =
> - sizeof(chip->pdata->config_data->cell_char_tbl);
> + int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
> u16 *temp_data;
> int ret = 0;
>
> - temp_data = kzalloc(table_size, GFP_KERNEL);
> + temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
> if (!temp_data)
> return -ENOMEM;
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [patch] max17042_battery: fix a couple buffer overflows
2012-03-15 17:20 ` Dirk Brandewie
@ 2012-05-05 2:26 ` Anton Vorontsov
0 siblings, 0 replies; 4+ messages in thread
From: Anton Vorontsov @ 2012-05-05 2:26 UTC (permalink / raw)
To: Dirk Brandewie
Cc: Dan Carpenter, Grant Likely, Rob Herring, MyungJoo Ham,
Kyungmin Park, Philip Rakity, linux-kernel, devicetree-discuss,
kernel-janitors
On Thu, Mar 15, 2012 at 10:20:34AM -0700, Dirk Brandewie wrote:
> On 03/15/2012 04:37 AM, Dan Carpenter wrote:
> >There are a couple issues here caused by confusion between sizeof()
> >and ARRAY_SIZE(). "table_size" should be the number of elements, but we
> >should allocate it with kcalloc() so that we allocate the correct number
> >of bytes.
> >
> >In max17042_init_model() we don't allocate enough space so we go past
> >the end of the array in max17042_read_model_data() and
> >max17042_model_data_compare().
> >
> >In max17042_verify_model_lock() we allocate the right amount of space
> >but we call max17042_read_model_data() with the wrong number of elements
> >and also in the for loop we go past the end of the array.
> >
> >Signed-off-by: Dan Carpenter<dan.carpenter@oracle.com>
> Acked-by: Dirk Brandewie <dirk.brandewie@gmail.com>
>
> Typo in first ack :-(
Applied, thanks! :-)
--
Anton Vorontsov
Email: cbouatmailru@gmail.com
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-05-05 2:26 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-03-15 11:37 [patch] max17042_battery: fix a couple buffer overflows Dan Carpenter
2012-03-15 16:57 ` Dirk Brandewie
2012-03-15 17:20 ` Dirk Brandewie
2012-05-05 2:26 ` Anton Vorontsov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).